All vulnerabilities
CVE-2026-85298

Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation

Google Cloud Application Integration
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026-08-27Fixed versionCVE List
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

  • 2026-08-27Application IntegrationCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project.

This vulnerability was patched on 27 August 2026, and no customer action is needed.

Text from CVE List

Affected versions 1

  • Application Integrationaffected: all versions before 2026-08-27CVE List

References 2