CVE-2026-4644 PUBLISHED

Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover

Assigner: GoogleCloud
Reserved: 23.03.2026 Published: 04.09.2026 Updated: 04.09.2026

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment.

This vulnerability was patched on 11 December 2025, and no customer action is needed.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Clear
CVSS Score: 8.5

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	None	Integrity	High
Attack Requirements	None	Availability	None	Availability	High
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	Google Cloud
Product	Integration Connectors
Versions	Default: unaffected affected from 0 to 2025-12-11 (excl.)

Credits

asterfiester reporter

References

https://docs.cloud.google.com/support/bulletins#gcp-2026-059

Problem Types

CWE-863 Incorrect Authorization CWE

Impacts

CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs