by Kastro
Paper/Archive/CVE-2026-19410

CVE-2026-19410

Google Cloud Google Cloud Build — Google Cloud Build Comment Control Bypass via Webhook Suppression

EPSS 0.2%CVSS 9.4
critical.is priorityof 100
30
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 9.5.095 × 201.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and no customer action is needed.

Affected

ProductAffectedFixed inSource
Google Cloud Build< 2026-06-242026-06-24CNA

Scores by source

GoogleCloud (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdocs.cloud.google.com/build/docs/release-notes#August_24_2026