CVE-2026-15587 Overview
CVE-2026-15587 is an improper privilege management vulnerability in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform. An authenticated attacker can escalate privileges to system-level administrative access by supplying a crafted internal authentication header. The flaw maps to [CWE-346: Origin Validation Error], where the platform trusted request-supplied identity metadata without sufficient verification. Google patched the issue in version 6.3.85, and no customer action is required because the fix was applied to the managed service.
Critical Impact
An authenticated user could obtain full administrative control over a Chronicle SOAR tenant, compromising security automation workflows, playbooks, and integrated data sources.
Affected Products
- Google SecOps (Chronicle SOAR) versions prior to 6.3.85
- Deployments on Google Cloud Platform
- Chronicle SOAR tenants managed by Google prior to the May 23, 2026 release
Discovery Timeline
- 2026-08-05 - CVE-2026-15587 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-15587
Vulnerability Analysis
The vulnerability resides in how Chronicle SOAR processed an internal authentication header used for service-to-service identity signaling. The platform treated the header as authoritative when determining the caller's privilege level. An authenticated attacker who could reach the application layer was able to forge this header value and assume system-level administrative identity. The result was full privilege escalation across confidentiality, integrity, and availability boundaries, with impact extending to subsequent systems trusted by the compromised tenant. Because Chronicle SOAR orchestrates security response workflows, administrative control over the tenant grants access to playbooks, API keys, and connected data sources.
Root Cause
The root cause is improper origin validation on an internal authentication header ([CWE-346]). The service accepted the header from external request paths that should have stripped or ignored it. Trust boundaries between the public request surface and internal microservice traffic were not consistently enforced, allowing header spoofing to bypass privilege checks.
Attack Vector
The attack vector is network-based and requires low privileges. An attacker with an authenticated session sends a request containing the crafted internal authentication header. The application layer honors the header and elevates the caller to system administrator. No user interaction is required, and attack complexity is low. Refer to the Google Cloud Chronicle Release Notes for vendor-published details.
// Code example not published by the vendor.
// Refer to the Google Cloud Chronicle Release Notes for details.
Detection Methods for CVE-2026-15587
Indicators of Compromise
- Unexpected assignment of system-level administrator roles to standard user accounts within Chronicle SOAR audit logs.
- Requests to Chronicle SOAR endpoints containing internal authentication headers originating from external clients.
- Playbook, integration, or API key modifications performed by accounts that do not normally hold administrative privileges.
Detection Strategies
- Review Chronicle SOAR audit logs for privilege changes and administrative actions performed prior to the deployment of version 6.3.85.
- Correlate authentication events with subsequent configuration changes to identify horizontal or vertical privilege escalation patterns.
- Alert on API requests that include headers reserved for internal service-to-service authentication.
Monitoring Recommendations
- Enable and centralize Chronicle SOAR audit log export to a SIEM for long-term retention and analytics.
- Monitor for anomalous administrative activity such as new integration installations, credential exports, or playbook edits.
- Track service account and API token usage for deviations from established baselines.
How to Mitigate CVE-2026-15587
Immediate Actions Required
- Confirm the tenant is running Chronicle SOAR version 6.3.85 or later; Google applied this patch to the managed service.
- Audit administrative role assignments and revoke any unexpected privilege grants made before the patch date.
- Rotate API keys, integration credentials, and service account tokens associated with the Chronicle SOAR tenant if any suspicious activity is observed.
Patch Information
Google patched CVE-2026-15587 in Chronicle SOAR version 6.3.85, released on May 23, 2026. The vendor states that no customer action is needed because the fix was deployed to the managed Google Cloud Platform service. See the Google Cloud Chronicle Release Notes for confirmation.
Workarounds
- No workaround is required; the vendor deployed the fix to all managed tenants.
- Maintain least-privilege role assignments within Chronicle SOAR to limit the blast radius of any future authentication weaknesses.
- Restrict network access to Chronicle SOAR administrative endpoints where possible using identity-aware proxies and conditional access policies.
# Verify Chronicle SOAR version through the platform UI or API
# Ensure the reported version is 6.3.85 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
