Google Cloud App Engine GraphQL API: Missing Auth Leakage
CVE-2026-8934 Published on June 22, 2026

Cross-Project Information Leakage in Google App Engine UI
A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched on 7 April 2026, and no customer action is needed.

NVD

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-8934 has been classified to as an AuthZ vulnerability or weakness.


Affected Versions

Google Cloud Cloud Console UIs: