CVE-2026-19410— Google Cloud Build Comment Control Bypass via Webhook Suppression
Quick assessment
Affected
Google Cloud Google Cloud Build
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Google 云平台（Google Cloud Platform）上 2026 年 6 月 24 日之前的 Google Cloud Build 中，GitHub 触发器评论控制存在一个不正确的授权漏洞，允许远程攻击者通过 Webhook 抑制机制在构建环境中执行未经审查的代码。 该漏洞已于 2026 年 6 月 24 日修复，客户无需采取任何行动。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Google Cloud | Google Cloud Build | < 2026-06-24 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19410
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Google Cloud Build Comment Control Bypass via Webhook Suppression
Source: CVE Program / CVE List V5
Vulnerability Description
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression.
This vulnerability was patched on 24 June 2026, and no customer action is needed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Google Cloud | Google Cloud Build | 0 ~ 2026-06-24 | - |
|
II. Public POCs for CVE-2026-19410
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19410
请登录查看更多情报信息。
Other References for CVE-2026-19410 (1)
IV. Related Vulnerabilities
Same vendor: Google Cloud
-
CVE-2026-19485
Bucket Squatting in Vertex AI Search for Commerce -
CVE-2026-12717
Remote Code Execution in BigQuery Data Transfer Service via -
CVE-2026-12710
Missing Authorization in Application Integration QueryEngine -
CVE-2026-15623
Authenticated Blind SQL Injection in Google Cloud SecOps SOA -
CVE-2026-15587
Privilege Escalation in Google SecOps (Chronicle SOAR) via C
Same weakness: CWE-367
-
CVE-2026-19118
Race condition vulnerability was identified in GitHub Enterp -
CVE-2026-78319
TOCTOU Vulnerability in file exchange -
CVE-2026-82238
filebrowser 2.24.0 Race Condition via TUS concurrent PATCH u -
CVE-2026-77573
Weblate: DNS rebinding in VCS operations allows server-side -
CVE-2026-58094
TOCTOU race in POSIX shared memory large page configuration
V. Comments for CVE-2026-19410
No comments yet