The vulnerability is an improper authorization flaw in the GitHub Trigger Comment Control feature of Google Cloud Build, classified as CWE‑863. A remote attacker who can send a specially crafted trigger comment can execute arbitrary code within the build environment, potentially compromising build artifacts and downstream services. It is inferred that the attacker must be able to create or modify such trigger comments to exploit the flaw.

All Google Cloud Build deployments that used builds prior to the 26 January 2026 release are impacted. Users with GitHub trigger comments enabled before this date are potentially exposed until the patch is applied.

The CVSS score of 8.6 underscores the high severity, but the EPSS score of less than 1% and absence from the CISA KEV catalog indicate a low likelihood of exploitation. Attackers would need to exploit the GitHub trigger interface remotely. It is inferred that attackers need the ability to create or modify trigger comments. As the fix was released on 26 January 2026 and no exploitation has been reported, the risk for current customers is mitigated when using a patched configuration.