Workload Identity Federation

Google Cloud IAM Workload Identity Federation Flaw Enables Cross-Organization Service Account Impersonation via Malformed OIDC Audience Claims (CVE-2026-69210)

Google fixes critical flaw CVE-2026-69210 in Cloud IAM Workload Identity Federation where improper validation of OIDC audience claims allowed cross-tenant service account hijacking.