Paper/Archive/CVE-2026-14934

CVE-2026-14934

Google Cloud BigQuery — Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise

EPSS 0.4%CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 28.7.287 × 205.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. This vulnerability was patched on 10 May 2026, and no customer action is needed.

Affected

ProductAffectedFixed inSource

BigQuery2025-10 – < 2026-05-102026-05-10CNA

Dataform2025-10 – < 2026-05-102026-05-10CNA

Colab Enterprise2025-10 – < 2026-05-102026-05-10CNA

Scores by source

GoogleCloud (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdocs.cloud.google.com/support/bulletins#gcp-2026-047