CVE-2026-2031

Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.

State: Published
Severity: 10.0 Critical
Published: May 15, 2026
Updated: May 15, 2026
Reserved: Feb 5, 2026

Description

An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker to disclose sensitive internal information and execute arbitrary code using specially crafted HTTP requests to inadvertently exposed internal API endpoints.

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear	GoogleCloud

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
Internal Integration Platform APIsGoogle Cloud	before 2026-01-23Affected

References

https://docs.cloud.google.com/gemini/enterprise/docs/release-notes#May_07_2026

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.