CVE-2026-2264— Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.
Possible ATT&CK Techniques 2AI
T1534 · Internal Spearphishing T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Google Cloud | Apigee-X | < 1.14.4 | affected |
< 1.15.2 | affected | ||
< 1.16.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-2264
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Google Cloud Apigee 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Google Cloud Apigee是美国谷歌（Google）公司的一个API管理平台，支持API网关、流量治理与接口安全管理功能。 Google Cloud Apigee存在安全漏洞，该漏洞源于允许远程攻击者执行服务端请求伪造并渗漏服务账户访问令牌，成功利用需要管理员初始配置不安全的API代理。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Google Cloud | Apigee-X | 0 ~ 1.14.4 | - |
II. Public POCs for CVE-2026-2264
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-2264
请登录查看更多情报信息。
Vendor Pages for CVE-2026-2264 (1)
IV. Related Vulnerabilities
Same vendor: Google Cloud
- CVE-2026-15623
Authenticated Blind SQL Injection in Google Cloud SecOps SOA - CVE-2026-15587
Privilege Escalation in Google SecOps (Chronicle SOAR) via C - CVE-2026-15810
Cross-Site Scripting (XSS) in Looker allows Admin Account Ta - CVE-2026-12715
Missing Authorization in Firebase Studio allows Cross-Tenant - CVE-2026-14934
Cross-Tenant Repository Takeover via Improper Access Control
Same weakness: CWE-918
- CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: - CVE-2026-35219
Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, S - CVE-2026-73560
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiMod - CVE-2026-48053
Kolibri has Unauthenticated Server-Side Request Forgery (SSR - CVE-2026-75053
IntelliJ IDEA 2026.2.1前SSRF漏洞
V. Comments for CVE-2026-2264
No comments yet