Is CVE-2026-2264 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2264 being exploited in the wild.

How severe is CVE-2026-2264?

High severity, with a CVSS score of 9.2, published 26 May 2026.

Which products and versions are affected?

Google Apigee Prior to 1-16-0-apigee-5; Google Apigee Hybrid 1.14.x < 1.14.4, 1.15.x < 1.15.2, 1.16.x < 1.16.1.

Is there a fix for CVE-2026-2264?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-2264 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-2264?

Check whether you run Google Apigee, Google Apigee Hybrid or Google Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2264: Google Cloud Apigee SSRF in SetIntegrationRequest policy

Q: Is there a fix for CVE-2026-2264?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-2264 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-2264?

Check whether you run Google Apigee, Google Apigee Hybrid or Google Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2264 · Severity: high · CVSS 9.2 · Published 2026-05-26

A security vulnerability in Google Cloud Apigee could allow an attacker to trick the system into making unauthorized requests to external servers. This flaw can be used to steal sensitive service account access tokens, which could grant an attacker broader access to cloud resources. The issue specifically affects organizations using the SetIntegrationRequest policy with insecure configurations.

Technologies: Google Cloud Platform. Vendors: Google.

Quick answers

Is CVE-2026-2264 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2264 being exploited in the wild.
How severe is CVE-2026-2264?: High severity, with a CVSS score of 9.2, published 26 May 2026.
Which products and versions are affected?: Google Apigee Prior to 1-16-0-apigee-5; Google Apigee Hybrid 1.14.x < 1.14.4, 1.15.x < 1.15.2, 1.16.x < 1.16.1.
Is there a fix for CVE-2026-2264?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-2264 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-2264?: Check whether you run Google Apigee, Google Apigee Hybrid or Google Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Google Cloud Apigee SetIntegrationRequest policy due to a lack of validation for the IntegrationRegion parameter. If an attacker can control a flow variable used for this parameter, they can redirect requests to an attacker-controlled host. This allows for the exfiltration of service account access tokens associated with the API proxy. Exploitation requires that an administrator has established an insecure configuration of the API proxy where flow variables are externally controllable. Google has patched the issue in Apigee release 1-16-0-apigee-5 and various Apigee Hybrid security patches.

Affected products

Google Cloud Apigee Prior to 1-16-0-apigee-5
Google Cloud Apigee Hybrid 1.14.x < 1.14.4, 1.15.x < 1.15.2, 1.16.x < 1.16.1

Timeline

2026-05-20: advisory: Google Cloud published security bulletin GCP-2026-034
2026-05-26: disclosed: CVE-2026-2264 published to NVD

References

https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.