An Incorrect Authorization vulnerability in the task configuration of Google Cloud Application Integration permits an authenticated Google Cloud user to execute arbitrary internal RPCs from within Google's production network under a privileged identity. This weakness stems from inadequate access control (CWE‑863) and can lead to significant confidentiality, integrity, and availability compromises by enabling unauthorized privileged operations.

The vulnerability affects Google Cloud Application Integration services that are running versions prior to 2026‑06‑17. Any deployment of this product on Google Cloud before the issued patch is potentially compromised.

The CVSS score of 9.4 indicates a critical level of danger. While the EPSS score is currently unavailable, the absence of a KEV listing suggests no publicly known exploits, but still poses a high risk for internal users. The attack vector is an authenticated internal user who can create and run internal‑only tasks, thereby invoking privileged RPCs without appropriate authorization. The potential impact is large, allowing execution of arbitrary internal code, manipulation of data, or disruption of services within the Google infrastructure. The vulnerability has been patched as of 17 June 2026, eliminating the risk for customers that have applied the patch.