Vulnerability Overview

Google Cloud has published security bulletin GC-2026-022 detailing CVE-2026-64205, a critical Server-Side Request Forgery (SSRF) protection bypass in the internal metadata proxy service of Google Cloud Run. The vulnerability permitted an attacker with indirect SSRF primitives inside a customer's container application to circumvent the mandatory Metadata-Flavor: Google header verification and retrieve OAuth2 access tokens belonging to the underlying service account.

Technical Root Cause Analysis

Google Cloud Compute Engine and Cloud Run provide instances with access to the internal instance metadata server at http://metadata.google.internal (or 169.254.169.254). To defend against arbitrary SSRF exploitation, Google enforces two protective layers:

  1. The request must originate from the internal loopback or container namespace.
  2. The HTTP request must contain the custom header Metadata-Flavor: Google.

The vulnerability existed in the gVisor-based container sandboxing runtime proxy used by Cloud Run to route container network egress. Due to an IPv6 dual-stack encapsulation parser bug, when an application made an HTTP request to an IPv6 link-local representation (http://[::ffff:169.254.169.254]) with specific transfer-encoding pipelining, the proxy stripped the incoming header validation checks before forwarding the socket to the host metadata listener:

GET /computeMetadata/v1/instance/service-accounts/default/token HTTP/1.1
Host: [::ffff:169.254.169.254]
Connection: keep-alive
X-Forwarded-For: 127.0.0.1

Because the internal filter treated the dual-stack representation as a trusted hypervisor health check, the metadata server replied with the active OAuth2 bearer token for the container's designated service account.

Blast Radius & Post-Exploitation

If the Cloud Run service is configured with the default Compute Engine service account (which frequently possesses the broad Editor role), an attacker who extracts this token can access all Cloud Storage buckets, BigQuery datasets, and Cloud SQL databases within the project. Even with custom service accounts, lateral privilege escalation within the GCP organization becomes possible.

Remediation & Cloud Hardening

Google Cloud resolved the issue globally across all managed Cloud Run regions by patching the proxy validation logic. Cloud security architects should immediately implement the following security best practices:

  • Avoid Default Service Accounts: Never assign the default Compute Engine service account to Cloud Run services; always bind custom, dedicated service accounts with minimal necessary permissions.
  • Enforce IAM Workload Identity Pools: Restrict service account token lifetimes and apply Organization Policy constraints (constraints/iam.disableServiceAccountKeyCreation).
  • Audit Cloud Audit Logs: Search Cloud Audit Logs for anomalous API requests originating from Cloud Run service accounts outside normal working hours.