Executive brief
Google Cloud Logging is a service that automatically routes event logs from cloud infrastructure and applications to configured destinations for storage and analysis. A vulnerability allowed attackers to hijack log sink destinations by recreating target Cloud Storage buckets under their control, causing sensitive logs to be diverted to unauthorized third parties. This could expose confidential audit trails, security events, and operational logs containing customer data and system details.
Technical details
The vulnerability is a logic flaw in Cloud Logging's sink destination validation that fails to prevent an attacker from taking over a log sink by recreating the target Cloud Storage bucket in an attacker-controlled Google Cloud project. When a log sink is configured to route logs to a specific bucket name, the service does not maintain sufficient state or ownership verification to detect when a bucket is recreated outside the original project context. An attacker with network access to Google Cloud APIs can identify target buckets, delete or wait for them to become available, and then recreate them in their own project, causing the log sink to continuously route sensitive logs to the attacker's infrastructure. This attack requires no authentication to the victim's project but assumes the attacker can monitor and act on bucket availability. The vulnerability affects Cloud Logging's core sink routing logic and has been addressed through improved bucket ownership and project-level isolation checks.
Affected products
- Google Cloud Logging
Timeline
- 2026-06-22: disclosed