CVE-2026-12710: Google Cloud Integration Auth Bypass Flaw

CVE-2026-12710 Overview

CVE-2026-12710 is a missing authorization vulnerability [CWE-862] in the QueryEngineTask component of Google Cloud Application Integration. The flaw affects service versions released between April 28, 2025 and April 4, 2026. An unauthenticated external attacker can reach the vulnerable code path over the network and retrieve sensitive internal data.

Google patched the issue on April 4, 2026 as a server-side fix. No customer action is required to receive the remediation.

Critical Impact
An unauthenticated network attacker can access sensitive internal data through the QueryEngineTask without any user interaction.

Affected Products

Google Cloud Application Integration (versions dated 2025-04-28 through 2026-04-04)
QueryEngineTask component within Application Integration
Managed Google Cloud service (patched centrally on 2026-04-04)

Discovery Timeline

2026-04-04 - Google Cloud releases server-side patch for the QueryEngineTask authorization flaw
2026-08-22 - CVE-2026-12710 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-12710

Vulnerability Analysis

Google Cloud Application Integration orchestrates data flows between Google Cloud services, SaaS applications, and enterprise systems. The QueryEngineTask executes query operations against integration data sources as part of an integration workflow.

The vulnerability stems from a missing authorization check on requests reaching QueryEngineTask. An external attacker can invoke the task path over the network without authentication and without user interaction. The task returns internal data that should be restricted to authorized tenants.

The issue is classified under CWE-862: Missing Authorization. Confidentiality and integrity impact are high, while availability is not affected. See the Google Cloud Release Notes for the vendor's remediation notice.

Root Cause

The QueryEngineTask code path did not enforce an authorization decision before executing the query and returning results. Access to internal data was gated by knowledge of the request path and parameters rather than by an identity or permission check tied to the caller.

Attack Vector

Exploitation requires network access to the Application Integration service endpoint. The attacker crafts a request targeting QueryEngineTask and receives sensitive internal data in the response. No credentials, tokens, or prior foothold are required, and the victim performs no action.

Google has not published exploit details, and no public proof-of-concept exists at the time of writing. The vulnerability description in prose is sufficient; no verified code artifacts are available.

Detection Methods for CVE-2026-12710

Indicators of Compromise

Unexpected inbound requests referencing QueryEngineTask endpoints in Application Integration audit logs before April 4, 2026
Query task executions with source identities that do not correspond to authorized service accounts or workflows
Anomalous outbound response sizes from Application Integration endpoints to external IP ranges

Detection Strategies

Review Google Cloud Audit Logs for integrations.googleapis.com API calls and correlate task executions against authorized workflow definitions
Alert on QueryEngineTask invocations that lack a corresponding parent integration trigger or expected caller identity
Baseline normal query task volume per project and flag statistical deviations during the affected window

Monitoring Recommendations

Enable Data Access audit logs for Application Integration if not already active, and forward to a centralized analytics platform
Monitor VPC Service Controls violations and denied requests targeting Application Integration APIs
Retain integration execution logs for the full affected window (2025-04-28 to 2026-04-04) to support retrospective hunting

How to Mitigate CVE-2026-12710

Immediate Actions Required

Confirm the patch status by reviewing the Google Cloud Application Integration release notes dated August 21, 2026
Conduct a retrospective log review of QueryEngineTask executions between 2025-04-28 and 2026-04-04 to identify unauthorized access
Rotate any secrets, credentials, or sensitive values that were referenced by integrations relying on QueryEngineTask during the affected window

Patch Information

Google patched CVE-2026-12710 on April 4, 2026 as a server-side change to the managed Application Integration service. Customers do not need to deploy an update, redeploy integrations, or modify configuration. The remediation applies uniformly to all tenants of the service.

Workarounds

No customer-side workaround is required because the fix is server-side and already deployed
Apply VPC Service Controls around Application Integration to restrict API reachability from untrusted networks going forward
Enforce least-privilege IAM on integration service accounts and disable unused integrations to reduce future exposure

bash

# Verify audit logging is enabled for Application Integration
gcloud logging read \
  'protoPayload.serviceName="integrations.googleapis.com" AND protoPayload.methodName:"QueryEngineTask"' \
  --project=PROJECT_ID \
  --freshness=400d \
  --limit=100