# CVE-2026-12879: Google Cloud Apigee improper input validation in BigQuery DAO

Source: https://junglewise.ai/threats/cve-2026-12879-google-cloud-apigee-improper-input-validation-in-bigquery-dao  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-12879 · Severity: info · CVSS 5.9 · Published 2026-07-09

A security vulnerability in Google Cloud Apigee's data access component could have allowed an authorized user to access data belonging to other customers. Apigee is a platform used by businesses to design, secure, and scale application programming interfaces (APIs). Google has already applied a fix to its servers, and no action is required from customers to protect their data.

Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-12879 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12879 being exploited in the wild.

**How severe is CVE-2026-12879?** Informational severity, with a CVSS score of 5.9, published 9 July 2026.

**Which products and versions are affected?** Google Apigee prior to 2026-06-12.

**Is there a fix for CVE-2026-12879?** A patch was published on 2026-06-12: Vulnerability patched on Apigee Servers Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12879 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-12879?** Check whether you run Google Apigee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability exists in the BigQuery Data Access Object (DAO) component of Google Cloud Apigee. The flaw is categorized as a 'Confused Deputy' (CWE-441) and an 'Externally Controlled Reference to a Resource in Another Sphere' (CWE-610). An authenticated attacker with high privileges could exploit this to bypass tenant isolation and exfiltrate data belonging to other tenants. The vulnerability affected Apigee X and was patched server-side by Google on June 12, 2026; Apigee hybrid was not affected.

## Affected products

- Google Cloud Apigee prior to 2026-06-12

## Timeline

- 2026-06-12: patched: Vulnerability patched on Apigee Servers
- 2026-07-08: advisory: Release notes published by Google Cloud
- 2026-07-09: disclosed: CVE published to NVD

## References

- [https://cloud.google.com/apigee/docs/release-notes](https://cloud.google.com/apigee/docs/release-notes)

## Related threats

- [Google Cloud Apigee SSRF in SetIntegrationRequest policy](https://junglewise.ai/threats/cve-2026-2264-google-cloud-apigee-ssrf-in-setintegrationrequest-policy)