Login Request a demo
Critical severity · published Aug 26, 2026
CVE-2026-12717
Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection
9.4
CVSS
0.6%
EPSS
No
On KEV
Description
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in the tenant project using crafted JDBC connection string parameters. This vulnerability was patched on 1 May 2026, and no customer action is needed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BD
BigQuery Data Transfer Service · Google Cloud
before 2026-05-01 · source: vendor
Affected product
BD
BigQuery Data Transfer Service
Google Cloud
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12717
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12717
docs.cloud.google.com
https://docs.cloud.google.com/support/bulletins#gcp-2026-056