SQL Injection and Security Boundary Bypass in Google BigQuery Forecasting Tool

CVE-2026-15829

What is CVE-2026-15829?

A SQL injection and security boundary bypass vulnerability exists within the prebuilt BigQuery forecasting tool from Google. This issue arises from the tool's handling of client-controlled parameters such as data_col, timestamp_col, and id_cols, which are processed as plain strings and incorporated without proper escaping into a generated SELECT statement. Although an allowedDatasets mechanism is employed to restrict queries, it only validates the history_data parameter; the assembled query is ultimately executed without re-validation. This flaw can be exploited by an attacker to bypass the configured allowedDatasets boundary, potentially allowing unauthorized access to read arbitrary BigQuery tables through crafted multi-statement or cross-dataset query blocks.

References