Critical severity · published Aug 22, 2026
CVE-2026-12710
Missing Authorization in Application Integration QueryEngineTask
9.3
CVSS
0.4%
EPSS
No
On KEV
Description
A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an external attacker to access sensitive internal data.
The issue was patched on April 4, 2026; no customer action is required.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Application Integration · Google Cloud
2025-04-28 before 2026-04-04 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12710
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12710
cloud.google.com
https://cloud.google.com/application-integration/docs/release-notes#August_21_2026
More from Application Integration
9.4
CVE-2026-81867
Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
9.4
CVE-2026-19759
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
8.3
CVE-2026-81375
Confused Deputy in Application Integration allows Internal File Read
7.3
CVE-2026-85298
Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation