CVE-2026-19486: Google Cloud Gemini SSRF Vulnerability

CVE-2026-19486 Overview

CVE-2026-19486 is a Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder. The flaw affects deployed applications built on versions prior to 2026-06-01 on Google Cloud Platform (GCP). An unauthenticated remote attacker can abuse the SSRF condition to reach the Compute Engine metadata service and exfiltrate the default service account access token. With that token, the attacker inherits the permissions granted to the Compute Engine default service account, enabling further access to Google Cloud resources. Google patched the underlying platform on 01 June 2026, but customers must redeploy previously deployed apps for the fix to take effect. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can steal the Compute Engine default service account access token and pivot to any GCP resource that account can access.

Affected Products

Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01
Applications deployed via App Builder before the 01 June 2026 patch
Google Compute Engine default service accounts associated with those deployments

Discovery Timeline

01 June 2026 - Google releases platform patch for the SSRF vulnerability
11 September 2026 - CVE-2026-19486 published to NVD
11 September 2026 - Last updated in NVD database

Technical Details for CVE-2026-19486

Vulnerability Analysis

The vulnerability resides in the App Builder component of Google Cloud Gemini Enterprise Agent Platform. The service accepts user-controlled input that is passed into a server-side HTTP request without adequate destination filtering. An attacker directs the server to issue a request to the internal GCP metadata endpoint at http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token. Because the request originates from the VM itself and includes the required metadata headers, the response returns a valid OAuth 2.0 access token for the Compute Engine default service account. No authentication is required to trigger the request path, and no user interaction is needed. The disclosed token can then be replayed against Google Cloud APIs from any external host until it expires.

Root Cause

The root cause is missing validation of outbound request targets inside App Builder [CWE-918]. The service does not restrict fetch operations from reaching link-local metadata IP ranges such as 169.254.169.254 or the metadata.google.internal hostname. Combined with the Compute Engine metadata server's trust in same-host requests, this design gap turns a request-forwarding feature into a credential disclosure primitive.

Attack Vector

The attack is delivered over the network against an exposed App Builder endpoint. The attacker submits a crafted request that causes the backend to fetch attacker-specified URLs. By pointing the fetch at the GCP metadata service, the attacker retrieves the service account bearer token from the JSON response. The stolen token grants API access under the identity and IAM roles of the Compute Engine default service account, which by default holds broad project-level permissions unless explicitly restricted.

No verified public exploit code is available. See the Google Cloud Release Notes for vendor guidance.

Detection Methods for CVE-2026-19486

Indicators of Compromise

Outbound HTTP requests from App Builder workloads to 169.254.169.254 or metadata.google.internal originating from user-driven request flows.
Unexpected use of Compute Engine default service account tokens from IP addresses outside the project's VM ranges.
GCP audit log entries showing API calls from the default service account against resources it has not previously accessed.

Detection Strategies

Enable and review Cloud Audit Logs for the affected project, focusing on serviceAccounts.getAccessToken and unusual oauth2.googleapis.com token usage.
Correlate VPC Flow Logs with application logs to identify server-side fetches targeting metadata IP ranges.
Alert on service account activity from geographic regions or ASNs that do not match legitimate workload egress.

Monitoring Recommendations

Continuously monitor IAM role usage of the Compute Engine default service account for privilege drift.
Track redeployment status of App Builder apps to confirm all workloads are running the patched platform release.
Feed GCP audit and VPC logs into a centralized analytics platform for cross-source correlation and long-term retention.

How to Mitigate CVE-2026-19486

Immediate Actions Required

Redeploy every App Builder application that was deployed before 01 June 2026 so the patched platform code takes effect.
Rotate the Compute Engine default service account keys and revoke any active OAuth tokens issued to affected workloads.
Audit recent GCP activity performed by the default service account and investigate any anomalous API calls.

Patch Information

Google patched the App Builder platform on 01 June 2026. The fix is applied at the platform layer, but customer applications must be redeployed to pick up the corrected runtime. Details are published in the Google Cloud Gemini Enterprise Agent Platform Release Notes.

Workarounds

Replace the Compute Engine default service account with a dedicated, least-privilege service account bound only to the APIs the application requires.
Enable the organization policy constraints/compute.requireShieldedVm and set metadata server access to require the Metadata-Flavor: Google header enforcement offered by GCE v1 metadata.
Restrict egress from App Builder workloads using VPC Service Controls and firewall rules that block direct access to 169.254.169.254 from application code paths.

bash

# Configuration example: enforce least-privilege service account on redeployment
gcloud iam service-accounts create appbuilder-runtime \
    --display-name="App Builder Runtime (least privilege)"

gcloud projects add-iam-policy-binding PROJECT_ID \
    --member="serviceAccount:appbuilder-runtime@PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/aiplatform.user"

# Redeploy the app bound to the dedicated service account
gcloud beta gemini-enterprise apps deploy APP_NAME \
    --service-account="appbuilder-runtime@PROJECT_ID.iam.gserviceaccount.com" \
    --region=REGION