Executive brief
Google Cloud Build is a continuous integration/continuous deployment (CI/CD) service that automatically builds and tests code from repositories. An authorization flaw in the GitHub trigger comment control system allowed attackers to bypass webhook verification and execute unreviewed code in the build environment. This could enable attackers to modify, steal, or compromise code and artifacts during the build process without detection or approval.
Technical details
An incorrect authorization vulnerability (CWE-863) in Google Cloud Build's GitHub trigger comment control mechanism allowed remote attackers to suppress webhook verification checks. By manipulating trigger configurations or webhook suppression settings, attackers could execute arbitrary code in the build environment without triggering the normal approval workflow. The vulnerability required network access to the Cloud Build service and knowledge of a target project's webhook configuration, but did not require prior authentication. The flaw was patched on June 24, 2026, and no manual customer action was required for remediation.
Affected products
- Google Cloud Build prior to 2026-06-24
Timeline
- 2026-08-31: disclosed
- 2026-06-24: patched