Escalated Access via MissingAuth in GCP BigQuery Repos
CVE-2026-14934 Published on July 13, 2026
Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise
A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover.
This vulnerability was patched on 10 May 2026, and no customer action is needed.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-14934 has been classified to as an AuthZ vulnerability or weakness.
Affected Versions
Google Cloud BigQuery:- Version 2025-10 and below 2026-05-10 is affected.
- Version 2025-10 and below 2026-05-10 is affected.
- Version 2025-10 and below 2026-05-10 is affected.