High severity · published Apr 23, 2026
CVE-2026-3259
Sensitive Data Disclosure in BigQuery via Materialized View Error Messages
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism in Google BigQuery on Google Cloud Platform allows an authenticated user to potentially disclose sensitive data using a crafted materialized view that triggers a runtime error during the refresh process.
This vulnerability was patched on 29 January 2026, and no customer action is needed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
BigQuery · Google Cloud
before 01/29/2026 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3259
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3259
docs.cloud.google.com
https://docs.cloud.google.com/bigquery/docs/release-notes/#April_15_2026
More from BigQuery
9.4
CVE-2026-14934
Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise