Login Request a demo
High severity · published Sep 4, 2026
CVE-2026-4644
Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover
8.5
CVSS
0.4%
EPSS
No
On KEV
Description
A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This vulnerability was patched on 11 December 2025, and no customer action is needed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Integration Connectors · Google Cloud
before 2025-12-11 · source: vendor
Affected product
IC
Integration Connectors
Google Cloud
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4644
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4644
docs.cloud.google.com
https://docs.cloud.google.com/support/bulletins#gcp-2026-059