CVE-2026-4644: Google Cloud Integration Connectors Escalation

CVE-2026-4644 Overview

CVE-2026-4644 is a missing authorization vulnerability in the HTTP Connector component of Google Cloud Integration Connectors on Google Cloud Platform (GCP). An authenticated user can attach an unauthorized service account to a connector and escalate privileges. Successful exploitation allows takeover of the target Google Cloud Project. Google patched the flaw on 11 December 2025, and no customer action is required. The weakness is classified under [CWE-863: Incorrect Authorization].

Critical Impact
An authenticated GCP user with low privileges can attach an arbitrary service account through the HTTP Connector and inherit its permissions, resulting in full Google Cloud Project takeover.

Affected Products

Google Cloud Integration Connectors (HTTP Connector) versions prior to 2025-12-11
Google Cloud Platform tenants using Integration Connectors
Any GCP Project that permitted service account attachment through the affected connector

Discovery Timeline

2025-12-11 - Google Cloud releases fix for Integration Connectors HTTP Connector
2026-09-04 - CVE-2026-4644 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-4644

Vulnerability Analysis

The HTTP Connector in Google Cloud Integration Connectors failed to enforce authorization checks when a caller attached a service account to a connector configuration. Integration Connectors execute API calls under the identity of the attached service account. Without a permission check verifying that the caller holds iam.serviceAccounts.actAs on the target service account, any authenticated principal with connector-management access could bind a privileged service account of their choosing. Once bound, the connector executes HTTP operations using the privileged identity. In many GCP Projects, service accounts hold roles such as roles/owner, roles/editor, or broad IAM administration privileges, which directly translate into project takeover.

Root Cause

The root cause is a missing authorization check on the service account attachment code path. The HTTP Connector accepted a caller-supplied service account reference without validating that the principal was permitted to impersonate or act as that account. This is a classic [CWE-863] flaw where an access control decision is either absent or evaluated on incomplete inputs.

Attack Vector

The attack requires network access to the GCP API surface and authentication as a low-privileged principal within the target project. The attacker configures an HTTP Connector and specifies a highly privileged service account as the execution identity. The connector then performs actions on the attacker's behalf using the privileged service account's permissions. Because the impact crosses trust boundaries — from the caller's identity to the service account's identity — the vulnerability scores high for scope confidentiality, integrity, and availability. See the Google Cloud Support Bulletin for vendor detail.

No public proof-of-concept code has been released for this vulnerability. Refer to the vendor bulletin for technical specifics.

Detection Methods for CVE-2026-4644

Indicators of Compromise

Creation or modification of Integration Connectors HTTP Connector resources referencing service accounts the invoking principal does not normally use
Cloud Audit Log entries showing google.cloud.connectors.v1.ConnectorsService.CreateConnection or UpdateConnection calls that attach privileged service accounts
Unexpected API activity performed by service accounts previously scoped to unrelated workloads
IAM policy changes, resource creation, or data exfiltration events initiated by service accounts shortly after connector configuration events

Detection Strategies

Correlate Integration Connectors administrative events with the identity of the calling principal and the service account being attached
Alert when a principal attaches a service account holding roles/owner, roles/editor, or IAM admin roles to any connector
Baseline normal service account usage per project and flag deviations, especially service accounts suddenly invoked through Integration Connectors

Monitoring Recommendations

Ingest Google Cloud Audit Logs (Admin Activity and Data Access) for the connectors.googleapis.com service into your SIEM or data lake
Monitor IAM changes that grant iam.serviceAccountUser or iam.serviceAccountTokenCreator on high-value service accounts
Review historical connector configurations created before 11 December 2025 for anomalous service account bindings

How to Mitigate CVE-2026-4644

Immediate Actions Required

Confirm your GCP tenant is running the post-11-December-2025 build of Integration Connectors; Google applied the fix platform-wide with no customer action required
Audit existing HTTP Connector configurations for service accounts that appear inconsistent with the connector's business purpose
Rotate credentials and review activity for any privileged service account that was attached to a connector by an unexpected principal
Apply least-privilege IAM to service accounts used by Integration Connectors

Patch Information

Google patched CVE-2026-4644 on 11 December 2025 as a platform-side fix. According to the Google Cloud Support Bulletin, no customer action is required to receive the fix. Customers should still validate their configuration and audit logs to ensure the flaw was not previously abused.

Workarounds

Restrict roles/connectors.admin and connector configuration permissions to a minimal set of trusted principals
Enforce iam.serviceAccounts.actAs boundaries so principals can only attach service accounts they are explicitly authorized to use
Use IAM Conditions or organization policies to limit which service accounts can be attached to Integration Connectors
Enable VPC Service Controls around Integration Connectors and related APIs to reduce blast radius

bash

# Example: list Integration Connector connections and inspect attached service accounts
gcloud beta connectors connections list \
  --location=us-central1 \
  --project=YOUR_PROJECT_ID \
  --format="table(name,serviceAccount,connectorVersion)"

# Example: constrain which service accounts a principal may act as
gcloud iam service-accounts remove-iam-policy-binding \
  PRIVILEGED_SA@YOUR_PROJECT_ID.iam.gserviceaccount.com \
  --member="user:untrusted-user@example.com" \
  --role="roles/iam.serviceAccountUser"