Privilege Escalation via AuthConfig in Google Cloud App Integration
CVE-2026-85298 Published on October 14, 2026

Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.

NVD

Vulnerability Analysis

CVE-2026-85298 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE

Weakness Type

What is an AuthZ Vulnerability?

The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

CVE-2026-85298 has been classified to as an AuthZ vulnerability or weakness.


Affected Versions

Google Cloud Application Integration: