CVE-2026-14934

Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise

State: Published
Severity: 9.4 Critical
Published: Jul 13, 2026
Updated: Jul 13, 2026
Reserved: Jul 7, 2026

Description

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover.

This vulnerability was patched on 10 May 2026, and no customer action is needed.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear	GoogleCloud

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
BigQueryGoogle Cloud	2025-10 to before 2026-05-10Affected
DataformGoogle Cloud	2025-10 to before 2026-05-10Affected
Colab EnterpriseGoogle Cloud	2025-10 to before 2026-05-10Affected

References

https://docs.cloud.google.com/support/bulletins#gcp-2026-047

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.