01 Record

CVE-2026-12710

Missing Authorization in Application Integration QueryEngineTask

CriticalPUBLISHEDCNA: GoogleCloud

Base score9.3 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Clear

View raw JSON CVE Program record

02 Description

Missing Authorization in Application Integration QueryEngineTask

03 Metadata

Published

2026-08-22 08:13Z11 HR AGO

Last updated

2026-08-22 08:13Z11 HR AGO

Reserved

2026-06-19

Assigning CNA

GoogleCloud

Record state

PUBLISHED

Severity

Critical (CVSS 9.3)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Clear

Weaknesses

CWE-862Missing AuthorizationClass

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

d602ac8fb87bc5a38c18175c3c76bbe1482477cebd0272e191494be93329b85d

04 Affected products

VendorProductVersionsPlatforms

Google CloudApplication Integration2025-04-28 to < 2026-04-04—

05 References

cloud.google.comhttps://cloud.google.com/application-integration/docs/release-notes#August_21_2026

06 Remediation

Access is now restricted and the issue is resolved. Integrations using QueryEngineTask for external traffic will return a PERMISSION_DENIED error. We recommend that customers remove or replace any QueryEngineTask (ASIS_TEMPLATE) tasks in their Application Integration workflows.