Executive brief
Google Cloud Build, a service that automates application builds and deployments, had a privilege escalation flaw in how it validated permissions for secrets stored in Secret Manager. For GitLab Enterprise and Bitbucket Data Center integrations, the service only checked permissions for its own service account but not for the user requesting the secret, allowing unauthorized secret access. This vulnerability has been patched to require both the user and service account to have proper permissions.
Technical details
This privilege escalation vulnerability affects Cloud Build's Secret Manager integration when used with GitLab Enterprise and Bitbucket Data Center connections. The root cause is incomplete authorization checking: Cloud Build was validating permissions only against the P4SA (service agent) credentials, bypassing validation of the calling principal's permissions. An attacker with access to a GitLab or Bitbucket integration could potentially retrieve secrets they were not authorized to access. The fix implements dual permission validation, requiring both the calling principal and P4SA to possess required secret permissions before retrieval. The vulnerability appears to have no CVE assignment and was addressed in a June 2026 update.
Affected products
- Google Cloud Build prior to 2026-06-24
Timeline
- 2026-06-24: disclosed
- 2026-06-24: patched