CVE-2026-4644— Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover
Quick assessment
Affected
Google Cloud Integration Connectors
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Google Integration Connectors是美国Google公司的一款谷歌云平台上的集成连接器服务。 Google Integration Connectors 2025-12-11之前版本存在授权问题漏洞，该漏洞源于HTTP Connector组件存在授权缺失，可能导致已认证用户提升权限，并通过未授权服务账户附件接管Google Cloud项目。
Possible ATT&CK Techniques 2 AI
T1548 · Abuse Elevation Control Mechanism T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Google Cloud | Integration Connectors | < 2025-12-11 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-4644
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover
Source: CVE Program / CVE List V5
Vulnerability Description
A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment.
This vulnerability was patched on 11 December 2025, and no customer action is needed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Clear
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Google Integration Connectors 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Google Integration Connectors是美国Google公司的一款谷歌云平台上的集成连接器服务。 Google Integration Connectors 2025-12-11之前版本存在授权问题漏洞，该漏洞源于HTTP Connector组件存在授权缺失，可能导致已认证用户提升权限，并通过未授权服务账户附件接管Google Cloud项目。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Google Cloud | Integration Connectors | 0 ~ 2025-12-11 | - |
|
II. Public POCs for CVE-2026-4644
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-4644
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-4644 (1)
IV. Related Vulnerabilities
Same vendor: Google Cloud
-
CVE-2026-79696
Remote Code Execution in Google ADK for Python via Incomplet -
CVE-2026-79707
Arbitrary File Read in Google Agent Development Kit (ADK) -
CVE-2026-19410
Google Cloud Build Comment Control Bypass via Webhook Suppre -
CVE-2026-19485
Bucket Squatting in Vertex AI Search for Commerce -
CVE-2026-12717
Remote Code Execution in BigQuery Data Transfer Service via
Same weakness: CWE-863
-
CVE-2026-14892
Tanium addressed an improper access controls vulnerability i -
CVE-2026-87046
Tanium addressed an improper access controls vulnerability i -
CVE-2026-87075
Tanium addressed an improper access controls vulnerability i -
CVE-2026-87544
Chrome 153前扩展程序授权错误，低危 -
CVE-2026-87575
Chrome 153.0.8010.36 前 Loader 授权错误
V. Comments for CVE-2026-4644
No comments yet