Is CVE-2026-14934 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14934 being exploited in the wild.

How severe is CVE-2026-14934?

High severity, with a CVSS score of 9.4, published 13 July 2026.

Which products and versions are affected?

Google BigQuery October 2025 to May 10, 2026; Google Colab Enterprise October 2025 to May 10, 2026; Google Dataform October 2025 to May 10, 2026.

Is there a fix for CVE-2026-14934?

A patch was published on 2026-05-10: Vulnerability was mitigated by Google. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14934 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-14934?

Check whether you run Google BigQuery, Google Colab Enterprise, Google Dataform or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14934: Google Cloud BigQuery and Dataform auth bypass in repository creation

CVE-2026-14934 · Severity: high · CVSS 9.4 · Published 2026-07-13

A security flaw was identified in Google Cloud's BigQuery, Dataform, and Colab Enterprise services that could have allowed an authorized user to take control of data repositories belonging to other customers. These services are used for large-scale data analysis, workflow management, and collaborative data science. An exploit could have resulted in unauthorized access to sensitive corporate data or the disruption of critical data operations across different organizations.

Technologies: Google Cloud Platform. Vendors: Google.

Quick answers

Is CVE-2026-14934 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14934 being exploited in the wild.
How severe is CVE-2026-14934?: High severity, with a CVSS score of 9.4, published 13 July 2026.
Which products and versions are affected?: Google BigQuery October 2025 to May 10, 2026; Google Colab Enterprise October 2025 to May 10, 2026; Google Dataform October 2025 to May 10, 2026.
Is there a fix for CVE-2026-14934?: A patch was published on 2026-05-10: Vulnerability was mitigated by Google. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14934 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-14934?: Check whether you run Google BigQuery, Google Colab Enterprise, Google Dataform or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) existed in the repository creation functionality of Google Cloud BigQuery, Dataform, and Colab Enterprise. The flaw allowed an authenticated attacker with low privileges to bypass intended access controls during the creation process, leading to privilege escalation and the ability to take over repositories belonging to other tenants (cross-tenant impact). The vulnerability was reachable over the network without user interaction. Google has patched the backend services, and the vulnerability is no longer exploitable; no customer action is required.

Affected products

Google Cloud BigQuery October 2025 to May 10, 2026
Google Cloud Dataform October 2025 to May 10, 2026
Google Cloud Colab Enterprise October 2025 to May 10, 2026

Timeline

2026-05-10: patched: Vulnerability was mitigated by Google.
2026-07-13: disclosed: Public advisory published.

References

https://docs.cloud.google.com/support/bulletins

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.