Critical severity · published Jul 13, 2026
CVE-2026-14934
Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise
9.4
CVSS
0.4%
EPSS
No
On KEV
Description
A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover.
This vulnerability was patched on 10 May 2026, and no customer action is needed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
BigQuery · Google Cloud
2025-10 before 2026-05-10 · source: vendor
CE
Colab Enterprise · Google Cloud
2025-10 before 2026-05-10 · source: vendor
DA
Dataform · Google Cloud
2025-10 before 2026-05-10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14934
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14934
docs.cloud.google.com
https://docs.cloud.google.com/support/bulletins#gcp-2026-047
More from BigQuery
7.1
CVE-2026-3259
Sensitive Data Disclosure in BigQuery via Materialized View Error Messages