CVE-2026-19759
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Google Cloud Application Integration versions prior to 2026-06-17 contain an Incorrect Authorization vulnerability in task configuration. An authenticated Google Cloud user can execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type.
Risk Assessment
An authenticated user could access internal Google services and perform operations with privileged permissions, potentially leading to privilege escalation and compromise of infrastructure security. The vulnerability was patched on 17 June 2026, so no customer action is needed.
Recommendation
No customer action is required — the vulnerability was patched on 17 June 2026. It is advisable to confirm that you are using the current version of the Google Cloud Application Integration service.
Other vulnerabilities in Google Cloud Application Integration
See all- CVE-2026-93327Critical
A deserialization of untrusted data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. The vulnerability was patched on 11 September 2026.
- CVE-2026-81867Critical
Google Cloud Application Integration versions prior to 2026-06-28 contain a Deserialization of Untrusted Data vulnerability in the JavaScript task. An authenticated user with standard permissions can run arbitrary code on shared production servers by bypassing parameter guards with a specially crafted script.
- CVE-2026-12710Critical
A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no customer action is required.
- CVE-2026-2031Critical
CVE-2026-2031 describes an improper access control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to January 23, 2026. This allows a remote, unauthenticated attacker to disclose sensitive information and execute arbitrary code using specially crafted HTTP requests.
- CVE-2026-85298High
Google Cloud Application Integration prior to version 2026-08-27 contains an incorrect authorization vulnerability in the AuthConfig validation and integration execution runtime that allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.
- CVE-2026-81375High
A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability was patched on 30 June 2026, and no customer action is needed.
Original NVD description (English source)
An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type. This vulnerability was patched on 17 June 2026, and no customer action is needed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS