PT-2026-43284 · Google Cloud · Apigee-X

Nikita Markevich · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-2264

Mitre

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens.

For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-2264

Affected Products

Apigee-X

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-2264 · Security Note
• https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins#gcp-2026-034 · Note