Critical severity · published Aug 31, 2026
CVE-2026-19410
Google Cloud Build Comment Control Bypass via Webhook Suppression
9.4
CVSS
0.2%
EPSS
No
On KEV
Description
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression.
This vulnerability was patched on 24 June 2026, and no customer action is needed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GC
Google Cloud Build · Google Cloud
before 2026-06-24 · source: vendor