6.9
Medium
CVE-2026-8934 A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud…
Description
A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched on 7 April 2026, and no customer action is needed.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cloud Console UIs 2026 | earliest → < 2026-04-07 | 2026-04-07 |
References
- docs.cloud.google.com docs.cloud.google.com
Timeline
- Published
- Last modified