CVE-2026-81375: Google Cloud Application Integration Flaw

CVE-2026-81375 Overview

CVE-2026-81375 is a Confused Deputy vulnerability [CWE-610] in the EmailTask component of Google Cloud Application Integration on Google Cloud Platform. An authenticated attacker can craft a malicious attachment file path to coerce the service into reading and exfiltrating arbitrary Google-internal files. The flaw affects versions prior to the 2026-06-30 release. Google patched the issue on 30 June 2026, and no customer action is required.

Critical Impact
An authenticated tenant can abuse the EmailTask attachment handler to read Google-internal files, resulting in cross-tenant confidentiality exposure within the managed service.

Affected Products

Google Cloud Application Integration (versions prior to 2026-06-30)
EmailTask component on Google Cloud Platform
Managed Application Integration tenants deployed before the 30 June 2026 patch

Discovery Timeline

2026-06-30 - Google releases the server-side patch for the EmailTask component
2026-09-28 - CVE-2026-81375 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in the NVD database

Technical Details for CVE-2026-81375

Vulnerability Analysis

The vulnerability resides in how the EmailTask component resolves file paths supplied as email attachments. Application Integration workflows allow authenticated tenants to configure an EmailTask that attaches files during execution. The service executes attachment reads using Google-internal service privileges rather than the caller's permissions. This confused deputy condition enables a tenant to request files outside of their authorization boundary and have the trusted service return them.

Because exfiltration occurs through the email delivery path, the attacker receives file contents as outbound email attachments. The scope extends beyond the vulnerable component, impacting other Google-internal resources accessible to the service identity.

Root Cause

The root cause is improper restriction of a trusted service's authority when acting on attacker-controlled input, classified as [CWE-610] Externally Controlled Reference to a Resource in Another Sphere. The EmailTask handler trusted tenant-supplied attachment paths without validating that the path belonged to resources the tenant was authorized to access. The service identity holds broader read permissions than any single tenant, which amplifies the impact.

Attack Vector

Exploitation requires an authenticated principal with permission to configure or execute an Application Integration workflow containing an EmailTask. The attacker supplies a crafted attachment file path that references Google-internal files instead of their own tenant assets. When the workflow runs, the service reads the targeted file under its own identity and delivers the contents as an email attachment. No user interaction is required beyond the attacker-initiated workflow execution.

See the Google Cloud Security Bulletin for the vendor-authoritative description of the flaw.

Detection Methods for CVE-2026-81375

Indicators of Compromise

Application Integration workflow executions where EmailTask attachment paths reference unexpected absolute paths or non-tenant resources.
Outbound emails originating from Application Integration runs with attachments that do not match any file the tenant uploaded.
Audit log entries showing successful file reads by the Application Integration service identity against resources outside the tenant's project boundary.

Detection Strategies

Review Google Cloud Audit Logs for integrations.googleapis.com API calls that configure or execute EmailTask steps with suspicious attachment path parameters.
Correlate workflow execution logs with outbound email destinations to identify delivery to external or attacker-controlled recipients.
Baseline normal attachment file path patterns per tenant and alert on deviations such as unusual directory prefixes or path traversal sequences.

Monitoring Recommendations

Enable Data Access audit logs for Application Integration and forward them to a centralized analytics platform for retention and query.
Monitor for new or modified Application Integration workflows that introduce EmailTask steps with dynamic attachment paths.
Track egress destinations of emails produced by Application Integration to detect unusual recipient domains.

How to Mitigate CVE-2026-81375

Immediate Actions Required

Confirm with Google Cloud that the tenant project is running the post-30 June 2026 release of Application Integration; no customer-side patch is required.
Review historical EmailTask executions for anomalous attachment paths and outbound recipients during the pre-patch window.
Rotate any secrets or credentials that may have been exposed if historical review surfaces suspicious attachment activity.

Patch Information

Google applied a server-side fix on 30 June 2026 to the Application Integration EmailTask component on Google Cloud Platform. The vendor confirms no customer action is needed. Full remediation details are documented in the Google Cloud Support Bulletin.

Workarounds

Restrict roles/integrations.integrationEditor and equivalent permissions to a minimal set of trusted principals to reduce the authenticated attack surface.
Enforce VPC Service Controls and organization policies that limit outbound email destinations from Application Integration workflows.
Require code review and change-management approval for workflows that add or modify EmailTask attachment configurations.

bash

# Configuration example: audit IAM bindings granting Application Integration edit rights
gcloud projects get-iam-policy PROJECT_ID \
  --flatten="bindings[].members" \
  --format="table(bindings.role, bindings.members)" \
  --filter="bindings.role:roles/integrations"