8.6 High

CVE-2026-3136 An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to…

Description

An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrary code in the build environment. This vulnerability was patched on 26 January 2026, and no customer action is needed.

Affected products and versions

Product	Affected versions	Fixed in
Cloud Build	Versions not published

Do you use Cloud Build?

Track this CVE Watch Cloud Build Check my SBOMs

www.cveye.io/en/cve/CVE-2026-3136

Timeline

Published March 3, 2026
Last modified March 4, 2026

References

docs.cloud.google.com docs.cloud.google.com

Track this CVE