CVE-2026-12717: Google BigQuery Data Transfer RCE Vulnerability

CVE-2026-12717 Overview

CVE-2026-12717 is an improper input validation vulnerability in the CData JDBC driver integration used by Google Cloud BigQuery Data Transfer Service. The flaw affects versions prior to the 2026-05-01 release running on Google Cloud Platform. An authenticated attacker can supply crafted Java Database Connectivity (JDBC) connection string parameters to achieve remote code execution inside the connector container. Successful exploitation allows the attacker to escalate privileges within the tenant project. Google patched the issue on 1 May 2026, and no customer action is required. The weakness maps to [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).

Critical Impact
An authenticated attacker can execute arbitrary code in the connector container and escalate privileges within the affected Google Cloud tenant project.

Affected Products

Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01
CData JDBC driver integration within BigQuery Data Transfer Service
Google Cloud Platform tenant projects using the affected connector

Discovery Timeline

2026-05-01 - Google Cloud releases patch for BigQuery Data Transfer Service
2026-08-26 - CVE-2026-12717 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-12717

Vulnerability Analysis

The vulnerability resides in how BigQuery Data Transfer Service processes JDBC connection string parameters passed to the CData JDBC driver. The service fails to validate or neutralize dangerous parameter values before they reach the underlying driver. An authenticated user with permission to configure data transfers can craft malicious connection string parameters that trigger code execution in the connector container. From that foothold, the attacker can escalate privileges within the tenant project by leveraging the connector's service identity and resource access. The issue is classified under [CWE-74] and impacts both the confidentiality and integrity of tenant workloads.

Root Cause

The root cause is insufficient sanitization of user-controlled JDBC connection string parameters. JDBC connection strings can carry driver-specific properties that alter runtime behavior, load classes, or reference external resources. When these properties are accepted without allow-listing or validation, they become an injection channel into the driver's execution context. The CData JDBC driver processes these parameters within the connector container, giving attacker-supplied input a path to native code execution.

Attack Vector

The attack requires network access to the Google Cloud BigQuery Data Transfer Service API and valid credentials with permission to create or modify a data transfer configuration. The attacker submits a transfer configuration containing a crafted JDBC connection string. The connector container parses the malicious parameters and executes attacker-controlled logic. The attacker then abuses the container's identity and IAM bindings to move laterally within the tenant project.

No verified public proof-of-concept code is available. See the Google Cloud Support Bulletin for vendor technical details.

Detection Methods for CVE-2026-12717

Indicators of Compromise

Data transfer configurations containing unusual JDBC connection string parameters, particularly those referencing external URLs, class loaders, or driver plugin paths.
Unexpected outbound network connections from BigQuery Data Transfer connector workloads to attacker-controlled infrastructure.
Cloud audit log entries showing new or modified bigquerydatatransfer.transferConfigs resources from unusual principals or locations.

Detection Strategies

Review Google Cloud Audit Logs for bigquerydatatransfer.transferConfigs.create and update events, correlating them against expected change management activity.
Alert on IAM role changes or service account token issuance events that occur shortly after transfer configuration changes.
Baseline connector egress traffic and flag deviations that indicate secondary payload retrieval or command-and-control activity.

Monitoring Recommendations

Ingest Google Cloud audit logs, VPC flow logs, and BigQuery Data Transfer Service logs into a centralized analytics platform for correlation.
Monitor tenant project IAM bindings for privilege changes tied to the BigQuery Data Transfer service identity.
Track anomalous use of service account credentials associated with data transfer workloads.

How to Mitigate CVE-2026-12717

Immediate Actions Required

Confirm that BigQuery Data Transfer Service in your GCP environment is running the 2026-05-01 or later release; Google applied the fix on the service side.
Audit existing transfer configurations for suspicious JDBC connection string parameters and remove any that are unrecognized.
Review IAM permissions for principals allowed to create or modify transfer configurations and apply least privilege.

Patch Information

Google patched CVE-2026-12717 on 1 May 2026 as a service-side update to BigQuery Data Transfer Service. No customer action is required to receive the fix. Refer to the Google Cloud Support Bulletin GCP-2026-056 for the vendor advisory.

Workarounds

Restrict bigquery.admin and bigquerydatatransfer.admin role assignments to a minimum set of trusted principals.
Enable organization policies that constrain which service accounts can be used by BigQuery Data Transfer Service.
Continuously review audit logs for changes to transfer configurations that include JDBC-based connectors.

bash

# Example: list BigQuery Data Transfer configurations for review
gcloud beta bigquery data-transfer configs list \
  --project=YOUR_PROJECT_ID \
  --location=us

# Example: inspect a specific configuration for suspicious params
gcloud beta bigquery data-transfer configs describe CONFIG_NAME \
  --project=YOUR_PROJECT_ID \
  --location=us