Confused Deputy Vulnerability in Google Cloud Application Integration
CVE-2026-81375

8.3HIGH

Key Information:

Vendor: Google Cloud
Status: Application Integration
Vendor: CVE Published:; 28 September 2026

🔔 Create Google Cloud Vulnerability Alert

What is CVE-2026-81375?

A Confused Deputy vulnerability exists in the EmailTask component of Google Cloud Application Integration, allowing an authenticated attacker to exploit a crafted attachment file path to read and exfiltrate arbitrary Google-internal files. This vulnerability was addressed with a patch on June 30, 2026, eliminating the risk without requiring any customer intervention.

Affected Version(s)

Application Integration 0 < 2026-06-30

References

https://docs.cloud.google.com/support/bulletins#gcp-2026-066

https://docs.cloud.google.com/application-integration/doc...

CVSS V4

Score:

8.3

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 28, 2026
Vulnerability Reserved
Aug 26, 2026

Credit

Guillaume Berleur

CVE-2026-81375 Data

JSON