Description
A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path.


This vulnerability was patched on 30 June 2026, and no customer action is needed.
Published: 2026-09-28
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Internal File Read
Action: No action needed
AI Analysis

Impact

A Confused Deputy flaw in the EmailTask component of Google Cloud Application Integration allows an authenticated attacker to specify a crafted attachment file path and read arbitrary Google‑internal files. The attacker could exfiltrate such files, thereby compromising the confidentiality of data stored within the Google Cloud environment. This weakness is classified as CWE‑610.

Affected Systems

The vulnerability applies to Google Cloud Application Integration running on the Google Cloud Platform before the 2026‑06‑30 release. No other products or versions are affected.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity. The vulnerability was fixed on 30 June 2026; customers using the 2026‑06‑30 release or later have no exploitation risk. The EPSS score is not available and the CVE is not listed in the CISA KEV catalog, suggesting no known public exploitation yet. Attackers would need authentication with access to the EmailTask functionality to successfully read files.

Generated by OpenCVE AI on September 28, 2026 at 12:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Maintain identity and access management best practices to ensure only authorized users can use the EmailTask feature.
  • Monitor Application Integration logs for anomalous attachment file path requests to detect potential misuse.
  • Continuously update Application Integration to the latest Google releases to protect against future vulnerabilities.

Generated by OpenCVE AI on September 28, 2026 at 12:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google application Integration
Vendors & Products Google
Google application Integration

Mon, 28 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Description A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability was patched on 30 June 2026, and no customer action is needed.
Title Confused Deputy in Application Integration allows Internal File Read
Weaknesses CWE-610
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/U:Clear'}

Subscriptions

Google Application Integration
cve-icon MITRE

Status: PUBLISHED

Assigner: GoogleCloud

Published:

Updated: 2026-09-28T13:31:29.289Z

Reserved: 2026-08-26T18:42:15.725Z

Link: CVE-2026-81375

cve-icon Vulnrichment

Updated: 2026-09-28T13:24:19.831Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-28T11:16:47.860

Modified: 2026-09-29T21:36:39.547

Link: CVE-2026-81375

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T16:15:03Z

Weaknesses
  • CWE-610

    Externally Controlled Reference to a Resource in Another Sphere