In plain language
What this advisory means
An important vulnerability was found in the JDBC driver used by Google Cloud's BigQuery Data Transfer Service before May 1, 2026. This flaw allowed attackers who already had access to use specially crafted connection parameters to run harmful code remotely and gain higher permissions within the affected project. Google fixed this issue on May 1, 2026, and no action is needed by customers now.
Technical explanation
How the issue affects the environment
The vulnerability in the BigQuery Data Transfer Service's JDBC driver is due to improper input validation of JDBC connection string parameters. An authenticated attacker could exploit this by inserting malicious parameters that lead to remote code execution within the connector container, thereby escalating privileges in the tenant project. This critical issue, tracked as CVE-2026-12717, was addressed in a patch released on May 1, 2026. Customers using versions prior to this date were at risk, but no ongoing exploit activity has been noted since the patch deployment.
Operational impact
Why teams should care
If exploited, attackers could execute arbitrary code remotely within the context of the connector container and gain increased permissions in the tenant's Google Cloud project, potentially leading to unauthorized access, data exposure, or service disruption. However, since the issue has been patched and no customer action is required, the risk to live deployments has been mitigated by Google.
Immediate action
The vulnerability was patched by Google on May 1, 2026. Customers do not need to take any action as the fix was applied by Google in the managed service environment.
Affected and fixed releases
Temporary risk reduction
No workaround is necessary as the issue was fixed directly by Google. Customers should ensure they operate on updated versions of BigQuery Data Transfer Service as managed by Google.
Evidence and validation checklist
- The vulnerability was documented in the official Google Cloud security bulletin GCP-2026-056.
- CVE identifier CVE-2026-12717 is assigned to this vulnerability.
- The issue affects the JDBC driver in BigQuery Data Transfer Service.
- The vulnerability allows remote code execution and privilege escalation.
- The vulnerability was patched on May 1, 2026, and no customer action is needed.
Authoritative reference
Google Cloud Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.