In plain language
What this advisory means
In the HTTP Connector component of Integration Connectors used in Google Cloud, there was a missing authorization check vulnerability discovered. This flaw allowed an authenticated attacker to attach an unauthorized service account, thereby escalating their privileges and potentially taking over an entire Google Cloud project. Google fixed this issue on December 11, 2025, and no customer action is required because the patch has already been applied.
Technical explanation
How the issue affects the environment
The vulnerability (CVE-2026-4644) is classified as a Missing Authorization flaw in the HTTP Connector within Integration Connectors prior to the December 11, 2025 patch. An authenticated attacker exploiting this vulnerability could attach a service account without proper authorization validation, leading to privilege escalation and project takeover in Google Cloud. The issue was addressed by Google through a patch released on December 11, 2025, which enforces proper authorization checks to prevent unauthorized service account attachments.
Operational impact
Why teams should care
An attacker with authentication could misuse the vulnerable HTTP Connector to escalate privileges by attaching service accounts without authorization, leading to potential takeover of Google Cloud projects. This could result in unauthorized access to resources, data breaches, and disruption of cloud services within the affected projects, posing significant risk to organizations relying on these services.
Immediate action
Google applied a patch on December 11, 2025, to Integration Connectors that enforces authorization checks on service account attachments in the HTTP Connector. Because this patch has already been deployed by Google, no customer action is required.
Affected and fixed releases
Temporary risk reduction
The official source does not specify any workaround; users should rely on the patch applied by Google as of December 11, 2025.
Evidence and validation checklist
- Official Google Cloud Security Bulletin GCP-2026-059
- CVE assignment CVE-2026-4644
- Date of patch December 11, 2025
- Description of Missing Authorization vulnerability in HTTP Connector
- Public advisory date September 4, 2026
Authoritative reference
Google Cloud Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.