CVE-2026-85267: Unauthenticated WebSocket Hijack in Google Cloud Shell
CVE-2026-85267 Published on October 20, 2026

Cross-Site WebSocket Hijacking in Google Cloud Shell
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched on 22 July 2026, and no customer action is needed.

NVD

Vulnerability Analysis

CVE-2026-85267 can be exploited with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
PASSIVE

Weakness Type

CWE-1385

Affected Versions

Google Cloud Cloud Shell: