CVE-2026-19410

Google Cloud Build Comment Control Bypass via Webhook Suppression

State: Published
Severity: 9.4 Critical
Published: Aug 31, 2026
Updated: Aug 31, 2026
Reserved: Aug 10, 2026

Description

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression.

This vulnerability was patched on 24 June 2026, and no customer action is needed.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear	GoogleCloud

Weaknesses

CWE-367 Time-of-check time-of-use (TOCTOU) race condition
CWE-345 Insufficient Verification of Data Authenticity

Affected Products

Product	Versions
Google Cloud BuildGoogle Cloud	before 2026-06-24Affected

References

https://docs.cloud.google.com/build/docs/release-notes#August_24_2026

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.