CVE-2026-85267— Cross-Site WebSocket Hijacking in Google Cloud Shell
Quick assessment
Affected
Google Cloud Cloud Shell
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 2026 年 7 月 22 日之前，Google Cloud Platform 上的 Cloud Shell 存在跨站 WebSocket 劫持漏洞。该漏洞允许未认证的攻击者通过跨域 WebSocket 请求劫持用户活跃的 Cloud Shell 会话，并窃取用户的 OAuth 访问令牌。 该漏洞已于 2026 年 7 月 22 日修复，客户无需采取任何操作。
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1190 · Exploit Public-Facing Application T1557 · Adversary-in-the-MiddleAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Google Cloud | Cloud Shell | < 2026-07-22 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85267
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-Site WebSocket Hijacking in Google Cloud Shell
Source: CVE Program / CVE List V5
Vulnerability Description
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request.
This vulnerability was patched on 22 July 2026, and no customer action is needed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Clear
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1385
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Google Cloud | Cloud Shell | 0 ~ 2026-07-22 | - |
|
II. Public POCs for CVE-2026-85267
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85267
请登录查看更多情报信息。
Other References for CVE-2026-85267 (1)
IV. Related Vulnerabilities
Same vendor: Google Cloud
-
CVE-2026-85298
Improper Authorization in Google Cloud Application Integrati -
CVE-2026-81375
Confused Deputy in Application Integration allows Internal F -
CVE-2026-81867
Deserialization of Untrusted Data in Application Integration -
CVE-2026-19759
Incorrect Authorization in Application Integration allows In -
CVE-2026-19407
GCS Bucket Squatting leading to RCE in Gemini Enterprise Age
Same weakness: CWE-1385
-
CVE-2026-107858
Cross-Site WebSocket Hijacking and Permissive CORS in Google -
CVE-2026-109330
Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijackin -
CVE-2026-104380
Punk versions from 0.48 before 0.55 for Perl route Extended -
CVE-2026-67405
RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validatio -
CVE-2026-13272
Security vulnerabilities have been addressed in IBM Verify I
V. Comments for CVE-2026-85267
No comments yet