CVE-2026-81375

Confused Deputy in Application Integration allows Internal File Read

View on CVE.org
Published Sep 28, 2026 CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Description
A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path.


This vulnerability was patched on 30 June 2026, and no customer action is needed.

Analysis

AI-generated

Technical impact

A Confused Deputy flaw in the EmailTask component of Google Cloud Application Integration allows an authenticated attacker to specify a crafted attachment file path and read arbitrary Google‑internal files. The attacker could exfiltrate such files, thereby compromising the confidentiality of data stored within the Google Cloud environment. This weakness is classified as CWE‑610.

Affected Systems

The vulnerability applies to Google Cloud Application Integration running on the Google Cloud Platform before the 2026‑06‑30 release. No other products or versions are affected.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity. The vulnerability was fixed on 30 June 2026; customers using the 2026‑06‑30 release or later have no exploitation risk. The EPSS score is not available and the CVE is not listed in the CISA KEV catalog, suggesting no known public exploitation yet. Attackers would need authentication with access to the EmailTask functionality to successfully read files.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Maintain identity and access management best practices to ensure only authorized users can use the EmailTask feature.
  • Monitor Application Integration logs for anomalous attachment file path requests to detect potential misuse.
  • Continuously update Application Integration to the latest Google releases to protect against future vulnerabilities.

Generated by OpenCVE AI on September 28, 2026 at 12:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Google
Google application Integration
Vendors & Products Google
Google application Integration
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability was patched on 30 June 2026, and no customer action is needed.
Title Confused Deputy in Application Integration allows Internal File Read
Weaknesses CWE-610
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/U:Clear'}
Weaknesses
  • CWE-610

    Externally Controlled Reference to a Resource in Another Sphere

Sources

Status
PUBLISHED
Assigner
GoogleCloud
Published
Updated
Sep 28, 2026, 1:31 PM
Reserved
Aug 26, 2026, 6:42 PM

View source JSON

Updated
Sep 28, 2026, 1:24 PM

JSON

Status
Awaiting Analysis
Published
Sep 28, 2026, 11:16 AM
Modified
Sep 29, 2026, 9:36 PM

View source JSON

No data.

Updated
Sep 28, 2026, 4:15 PM

JSON