Topic

Google Cloud: news, advisories and analysis

22 articlesUpdated 19 Oct 2026

CyberSecureToday covers Google Cloud across 22 articles published between 16 Sep 2026 and 19 Oct 2026. The coverage includes 20 vulnerability advisories and 2 analysis or guidance pieces. 20 advisories are rated critical or high severity.

Stories on Google Cloud most often intersect with Cloud Security, GCP and Privilege Escalation, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Google Cloud Enterprise Services Deserialization Flaw Disclosed”, was published 19 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
Google Cloud Enterprise Services Deserialization Flaw Disclosed
CVE-2026-81867 in Google Cloud Enterprise Services (Deserialization) allows remote attackers to trigger arbitrary code execution. Patch: Version 2026-06 an
Aisha Noor19 Oct 202610 min read
ThreatsCloud & SaaSHigh
Google Cloud Enterprise Services Path Traversal Flaw Disclosed
CVE-2026-79707 in Google Cloud Enterprise Services (Path Traversal) allows remote attackers to trigger arbitrary code execution. Patch: Version 1.21.0.
Aisha Noor19 Oct 202610 min read
ThreatsCloud & SaaSCritical
Google Cloud Enterprise Services Authorization Bypass Flaw Disclosed
CVE-2026-19759 in Google Cloud Enterprise Services (Authorization Bypass) allows remote attackers to trigger arbitrary code execution. Patch: Version 2026-
Aisha Noor19 Oct 202610 min read
ThreatsCloud & SaaSCritical
Google Cloud Enterprise Services Vulnerability Disclosed
CVE-2026-86708 in Google Cloud Enterprise Services (Security Vulnerability) allows remote attackers to trigger arbitrary code execution. Patch: Vendor secu
Aisha Noor18 Oct 202610 min read
ThreatsCloud & SaaSHigh
Google Cloud Workload Identity Federation OIDC Token Bypass Flaw CVE-2026-19410 Remediated
Google Cloud updates authentication libraries for CVE-2026-19410 where improper audience validation allowed external OIDC tokens to impersonate IAM service accounts.
Aisha Noor14 Oct 20268 min read
ThreatsCloud & SaaSHigh
Google Cloud Run & Artifact Registry Privilege Escalation Flaw CVE-2026-79696 Patched
Google Cloud resolves a high-severity privilege escalation flaw in Cloud Run and Artifact Registry auth helpers (CVE-2026-79696) exposing service account tokens.
Priya Raman14 Oct 20268 min read
NewsCloud & SaaSHigh
Google Cloud Armor Flaw Allowed WAF Bypass via HTTP/3 Stream Desynchronization
Google patches a high-severity desynchronization flaw in Cloud Armor edge proxies that allowed attackers to smuggle malicious HTTP/3 payloads past WAF rules.
Priya Raman13 Oct 20268 min read
NewsCloud & SaaSCritical
Google Vertex AI Agent Builder Flaw Enables Sandbox Breakout and Token Exfiltration
Google patches a critical breakout flaw in Vertex AI Agent Builder (CVE-2026-76215) allowing recursive tool invocations to escape sandboxes and exfiltrate IAM tokens.
CST Editorial Desk12 Oct 20268 min read
ThreatsCloud & SaaSCritical
Google Cloud Workload Identity Flaw Enabled Cross-Organization Service Account Impersonation
Google fixes critical flaw CVE-2026-69210 in Cloud IAM Workload Identity Federation where improper validation of OIDC audience claims allowed cross-tenant service account hijacking.
CST Editorial Desk11 Oct 20268 min read
ThreatsCloud & SaaSCritical
Google Cloud Run Metadata Service SSRF Filter Bypass Enables IAM Service Account Token Exfiltration
A security flaw in Google Cloud Run's internal metadata proxy allows server-side request forgery to steal workload identity IAM tokens.
CST Editorial Desk10 Oct 20268 min read
ThreatsCloud & SaaSHigh
Google Cloud Armor HTTP/2 Adaptive Protection Rule Bypass Permits WAF Circumvention (CVE-2026-56214)
Google Cloud Security discloses a vulnerability in Cloud Armor WAF Adaptive Protection allowing attackers to bypass rate limiting via multiplexed HTTP/2 frames.
CST Editorial Desk9 Oct 20268 min read
ThreatsCloud & SaaSHigh
Google Cloud Run Internal Metadata Proxy Flaw Permits Cross-Container Service Account Token Extraction
Google Cloud releases emergency advisory for CVE-2026-45129, resolving an internal metadata server proxy flaw in Cloud Run allowing cross-container token leakage.
CST Editorial Desk7 Oct 20268 min read
ThreatsCloud & SaaSCritical
Google Cloud Vertex AI Prompt Armor Bypass Exposes Enterprise Agent RAG Pipelines
Google Cloud security bulletin resolves a filter evasion flaw in Vertex AI Prompt Armor allowing jailbreak payload delivery to enterprise RAG agents.
Aisha Noor6 Oct 20268 min read
ThreatsCloud & SaaSCritical
Google Cloud Run Linux Namespace Confusion Flaw Enables Cross-Container Node Escape CVE-2026-49102
Google Cloud Security Bulletin GCP-2026-068 details a gVisor sandboxing namespace defect in Cloud Run worker nodes permitting local privilege escalation.
Aisha Noor28 Sep 20269 min read
ThreatsCloud & SaaSHigh
Google Cloud Service Mesh Vulnerability Exposes Protected Endpoints to RBAC Authorization Bypass CVE-2026-73513
Google Cloud Bulletin GCP-2026-057 warns of an Envoy Proxy safe_regex parsing flaw in Cloud Service Mesh causing negative RBAC authorization policies to fail open.
Aisha Noor27 Sep 20268 min read
ThreatsCloud & SaaSHigh
Google Cloud Integration Connectors Authorization Flaw Enables Service Account Privilege Escalation CVE-2026-4644
Google Cloud Bulletin GCP-2026-059 details missing authorization flaw CVE-2026-4644 in Integration Connectors enabling project-level privilege escalation.
Mei-Lin Chen26 Sep 202614 min read
ThreatsCloud & SaaSHigh
Google Kubernetes Engine Container Escape Vulnerability Enables Node Compromise Across Multi-Tenant Clusters
Google Cloud discloses and mitigates a high-severity container escape flaw in GKE node kernels, preventing unprivileged workloads from compromising host nodes.
Aisha Noor24 Sep 202617 min read
ThreatsCloud & SaaSHigh
Google Cloud OS Login Privilege Escalation Flaw Exposes Compute Engine Instances to Root Takeover CVE-2020-8907
Google Cloud resolves a privilege escalation flaw in Compute Engine guest-oslogin that allowed users with compute.osLogin IAM permissions to gain root access.
Aisha Noor24 Sep 202617 min read
ThreatsCloud & SaaSCritical
Google Cloud Patches Critical GKE Multi-Cloud Flaw Enabling Cross-Project Cluster Hijack and Service Account Impersonation
Google Cloud remediates critical GCP-2026-058 flaw in GKE Multi-Cloud APIs where missing project checks enabled unauthorized cluster registration and IAM impersonation.
CST Editorial Desk23 Sep 202616 min read
ThreatsCloud & SaaSHigh
Google Cloud Gemini Agent App Builder Flaw CVE-2026-19486 Leaks Compute Engine Service Account Tokens
Google Cloud resolves high-severity SSRF vulnerability CVE-2026-19486 in Gemini Enterprise Agent Platform App Builder allowing attackers to harvest GCP IAM service account tokens.
Aisha Noor21 Sep 202615 min read
InsightsCloud & SaaS
Google Cloud Security Advisory: GCP Guest OS Login Privilege Escalation Flaw Dissected
Technical analysis of Google Cloud Platform guest-oslogin flaw CVE-2020-8903 enabling non-administrative users to escalate privileges to root.
Mei-Lin Chen18 Sep 202610 min read
InsightsCloud & SaaS
Google Cloud GKE Workload Identity Privilege Escalation: Cloud Threat Forensics & Hardening
Technical analysis of Google Cloud Platform (GCP) Kubernetes Workload Identity metadata impersonation vectors, token theft forensics, and enterprise IAM hardening.
Mei-Lin Chen16 Sep 202612 min read