PT-2026-41309 · Google Cloud · Application Integration

Arvin Shivram · Published 2026-05-15 · Updated 2026-05-24 · CVE-2026-2031

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear

Name of the Vulnerable Software and Affected Versions Google Cloud Application Integration versions prior to 2026-01-23

Description Improper Access Control in several internal API endpoints allows a remote, unauthenticated attacker to disclose sensitive internal information and execute arbitrary code. This is achieved by sending specially crafted HTTP requests to internal API endpoints that were inadvertently exposed. The issue involves debug endpoints that allow the configuration of privileged workflows, leading to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a target machine.

Recommendations Update to the version released on or after 2026-01-23.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2031

Affected Products

Application Integration

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2031 · Security Note
• https://t.me/CVEtracker/53933 · Telegram Post
• https://twitter.com/UpwindMDR/status/2055368184979489204 · Twitter Post
• https://twitter.com/securestep9/status/2058511533005578390 · Twitter Post
• https://t.me/cveNotify/163896 · Telegram Post
• https://docs.cloud.google.com/gemini/enterprise/docs/release-notes#May_07_2026 · Note