Missing Auth in GCE disks.createSnapshot API allows cross-project data exfil
CVE-2026-85299 Published on October 27, 2026

Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August 2026, and no customer action is needed.

NVD

Vulnerability Analysis

CVE-2026-85299 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-85299 has been classified to as an AuthZ vulnerability or weakness.


Affected Versions

Google Cloud Compute Engine: