# CVE-2026-12717: Google BigQuery Data Transfer Service JDBC driver input validation bypass

Source: https://junglewise.ai/threats/cve-2026-12717-google-bigquery-data-transfer-service-jdbc-driver-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-12717 · Severity: high · Published 2026-08-26

BigQuery Data Transfer Service is a Google Cloud service that enables automated, scheduled data movement between cloud storage systems. An authenticated attacker could exploit improper input validation in the JDBC driver by crafting malicious connection parameters, allowing remote code execution within the connector container and privilege escalation in the tenant project.

Technologies: [Google Cloud Platform](https://junglewise.ai/threats/technologies/google-cloud-platform). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-12717 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12717 being exploited in the wild.

**How severe is CVE-2026-12717?** High severity, published 26 August 2026.

**Which products and versions are affected?** Google BigQuery Data Transfer Service prior to May 1, 2026.

**Is there a fix for CVE-2026-12717?** A patch was published on 2026-05-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12717 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-12717?** Check whether you run Google BigQuery Data Transfer Service or Google Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper input validation flaw in the JDBC driver component of BigQuery Data Transfer Service (versions prior to May 1, 2026). An authenticated attacker can craft malicious JDBC connection string parameters to achieve remote code execution (RCE) within the connector container and subsequently escalate privileges to the tenant project level. The attack requires authentication to the service, making it a post-authentication privilege escalation vector. The vulnerability was patched on May 1, 2026, and all affected versions should be updated to the patched release.

## Affected products

- Google BigQuery Data Transfer Service prior to May 1, 2026

## Timeline

- 2026-05-01: patched
- 2026-08-26: disclosed

## References

- [https://docs.cloud.google.com/support/bulletins/index](https://docs.cloud.google.com/support/bulletins/index)

## Related threats

- [AMD EPYC 5th generation processor data cache information leak](https://junglewise.ai/threats/cve-2024-36350-gcp-2026-081)
- [Istio authentication bypass or access control vulnerability](https://junglewise.ai/threats/cve-2026-31836-gcp-2026-080)
- [Slurm multiple vulnerabilities in Cluster Toolkit](https://junglewise.ai/threats/cve-2026-65107-slurm-sbcast-shared-library-validation-bypass)
- [Google Application Integration deserialization of untrusted data in SubWorkflow](https://junglewise.ai/threats/cve-2026-93327-gcp-2026-074)
- [Google Compute Engine incorrect authorization in disk access](https://junglewise.ai/threats/cve-2026-85299-gcp-2026-073)