CVE-2026-2264: Google Cloud Apigee SSRF Vulnerability

CVE-2026-2264 Overview

CVE-2026-2264 is a Server-Side Request Forgery (SSRF) vulnerability in the Google Cloud Apigee SetIntegrationRequest policy. Remote attackers can abuse the flaw to issue arbitrary server-side requests from the Apigee runtime and exfiltrate Google Cloud service account access tokens. Successful exploitation requires an administrator to have first deployed an insecure API proxy configuration that exposes the policy to untrusted input. Once exploited, the attacker obtains credentials tied to the proxy's service account, enabling lateral movement across Google Cloud Platform (GCP) resources accessible to that identity.

Critical Impact
Attackers can exfiltrate GCP service account access tokens through the metadata server, granting unauthorized access to cloud resources bound to the compromised identity.

Affected Products

Google Cloud Apigee API Management
Apigee API proxies using the SetIntegrationRequest policy
Workloads tied to Apigee runtime service accounts on GCP

Discovery Timeline

2026-05-26 - CVE-2026-2264 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-2264

Vulnerability Analysis

The vulnerability resides in the Apigee SetIntegrationRequest policy, which constructs and dispatches integration requests from the Apigee runtime. When an API proxy is configured to derive request targets or parameters from client-controlled input without strict validation, an attacker can coerce the runtime into sending requests to internal endpoints. The most consequential target is the GCP metadata server at metadata.google.internal, which returns OAuth 2.0 access tokens for the proxy's bound service account.

The issue is classified under [CWE-918] Server-Side Request Forgery. Because the Apigee runtime executes the outbound request with its own network identity and credentials, requests to internal-only services bypass perimeter controls. Captured tokens can then be replayed against Google APIs to read storage buckets, invoke functions, or pivot into other tenant resources.

Root Cause

The root cause is insufficient destination validation within the SetIntegrationRequest policy when proxy authors permit untrusted data to influence the integration target. The policy does not enforce a deny list for sensitive internal hosts such as the GCP metadata endpoint, and it does not require explicit allow lists for outbound destinations.

Attack Vector

The attack vector is network-based and requires no authentication when the vulnerable proxy is publicly exposed. An attacker submits a crafted API request that drives the SetIntegrationRequest policy to call http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token. The Apigee runtime returns the metadata server response, including the bearer token, to the attacker. The attacker then uses the token to authenticate to Google Cloud APIs.

No verified public exploit code is available. See the Google Cloud Security Bulletin GCP-2026-034 for vendor technical details.

Detection Methods for CVE-2026-2264

Indicators of Compromise

Outbound requests from Apigee runtime instances to metadata.google.internal or 169.254.169.254 that originate from proxy execution contexts rather than infrastructure tooling.
API proxy responses containing strings matching OAuth access token patterns such as ya29. returned to external clients.
Unexpected Google Cloud API calls authenticated with the Apigee runtime service account from non-Apigee source IPs.

Detection Strategies

Audit deployed API proxy bundles for SetIntegrationRequest policies that build URLs or integration identifiers from request variables such as request.queryparam.*, request.header.*, or message payload content.
Enable Apigee runtime debug sessions and inspect target URLs resolved at execution time for references to internal metadata endpoints.
Correlate Cloud Audit Logs for the Apigee service account against expected workload behavior to flag anomalous token usage.

Monitoring Recommendations

Stream Apigee analytics, VPC Flow Logs, and Cloud Audit Logs into a centralized analytics platform and alert on metadata host access from proxy workloads.
Track service account token issuance frequency and geographic source of subsequent API calls to detect credential replay.
Monitor for new or modified API proxy revisions that introduce dynamic targets in integration policies.

How to Mitigate CVE-2026-2264

Immediate Actions Required

Inventory all Apigee API proxies and identify any using the SetIntegrationRequest policy with client-controlled target parameters.
Rotate access tokens and credentials for service accounts bound to potentially exposed Apigee runtimes.
Apply the fixes referenced in Google Cloud Security Bulletin GCP-2026-034 across affected Apigee environments.
Restrict the Apigee runtime service account to the minimum IAM roles required for legitimate integrations.

Patch Information

Google has addressed the vulnerability in the Apigee platform. Refer to the Google Cloud Security Bulletin GCP-2026-034 for fixed versions, rollout status across Apigee tiers, and any required customer actions.

Workarounds

Refactor API proxies so the SetIntegrationRequest policy uses static, hardcoded integration targets rather than expressions derived from request input.
Enforce strict input validation and allow lists for any variable that influences integration request construction.
Block egress from Apigee runtimes to the GCP metadata server where workloads do not legitimately require it, and prefer Workload Identity Federation patterns that limit token scope.
Apply organizational policy constraints to prevent deployment of proxy revisions that reference untrusted variables in integration policies.

bash

# Example: search deployed proxy bundles for risky SetIntegrationRequest usage
grep -RIn "SetIntegrationRequest" ./apigee-proxies/ \
  | grep -E "request\.(queryparam|header|formparam|content)"