Executive brief
Google Cloud Application Integration is a service used to connect various applications and data sources within a business environment. A security flaw allowed unauthorized individuals to access internal management interfaces that were never intended to be public. An attacker could have used this access to steal sensitive internal data or execute unauthorized commands, potentially compromising the entire integration platform.
Technical details
An improper access control vulnerability (CWE-862) existed in several internal API endpoints of the Google Cloud Application Integration platform. The root cause was the inadvertent exposure of internal-only endpoints to the public internet without requiring authentication. A remote, unauthenticated attacker could send specially crafted HTTP requests to these endpoints to disclose sensitive internal information or achieve arbitrary code execution. Google has since restricted access to these endpoints, and no customer action is required as the fix was applied server-side.
Affected products
- Google Google Cloud Application Integration Prior to 2026-01-23
Timeline
- 2026-01-23: patched: Internal API access restricted
- 2026-05-07: advisory: Security notice included in Gemini Enterprise release notes
- 2026-05-15: disclosed: CVE published to NVD