Resource Proxy Vulnerability in Google Cloud Monitoring by Google

CVE-2026-107365

What is CVE-2026-107365?

A vulnerability exists within Google Cloud Monitoring that allows users with query access to exploit the resource proxy feature. This exploitation can enable unauthorized requests to various Cloud Monitoring API paths using the compromised data source credentials. Consequently, this grants the attacker access to sensitive data from any project that the compromised credentials can access. The impact is particularly pronounced when OAuth identities are forwarded or Workload Identity Federation is employed, allowing for potential misuse based on the permissions assigned to the credentials in question. The vulnerability was addressed in Google Cloud Monitoring plugin version 12.6.7.

References