Login Request a demo
Critical severity · published May 26, 2026
CVE-2026-2264
Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.
9.2
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Apigee-X · Google Cloud
before 1.14.4; before 1.15.2; before 1.16.1 · source: vendor
Affected product
AP
Apigee-X
Google Cloud
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2264
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2264
docs.cloud.google.com
https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins#gcp-2026-034