CVE-2026-4644
Received Received - Intake

Privilege Escalation in Google Cloud Integration Connectors

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GoogleCloud

Description
A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This vulnerability was patched on 11 December 2025, and no customer action is needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-4644
EUVD
EUVD-2026-70996

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
google cloud_integration_connectors to 2025-12-11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Missing Authorization vulnerability in the HTTP Connector of Google Cloud Integration Connectors. It allows an authenticated user to escalate privileges and take over a Google Cloud Project by attaching unauthorized service accounts. The issue was present in versions prior to 2025-12-11.

Impact Analysis

An attacker with authenticated access could exploit this to gain elevated privileges, potentially taking control of a Google Cloud Project. This could lead to unauthorized access to sensitive data, resource misuse, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations must ensure proper authorization controls to maintain compliance.

Mitigation Strategies

No immediate action is required as this vulnerability was patched on 11 December 2025 and no customer action is needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4644. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart