Quick answers
- Is CVE-2026-12717 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12717 being exploited in the wild.
- How severe is CVE-2026-12717?
- High severity, published 26 August 2026.
- Which products and versions are affected?
- Google BigQuery Data Transfer Service prior to May 1, 2026.
- Is there a fix for CVE-2026-12717?
- A patch was published on 2026-05-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-12717 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-12717?
- Check whether you run Google BigQuery Data Transfer Service or Google Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper input validation flaw in the JDBC driver component of BigQuery Data Transfer Service (versions prior to May 1, 2026). An authenticated attacker can craft malicious JDBC connection string parameters to achieve remote code execution (RCE) within the connector container and subsequently escalate privileges to the tenant project level. The attack requires authentication to the service, making it a post-authentication privilege escalation vector. The vulnerability was patched on May 1, 2026, and all affected versions should be updated to the patched release.
Affected products
- Google BigQuery Data Transfer Service prior to May 1, 2026
Timeline
- 2026-05-01: patched
- 2026-08-26: disclosed