CVE-2026-8934

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched on 7 April 2026, and no customer action is needed.

Score

CVSS 4.0 6.9 Medium

Status

Awaiting Analysis - f45cbf4e-4146-4068-b7e1-655ffc2c548c

Published

2026-06-22

Last modified

2026-10-25

Weaknesses

CWE-862

Affected products

• Cloud Console Uis (Google Cloud)

References

• https://docs.cloud.google.com/support/bulletins#gcp-2026-038