PT-2026-43284 · Google Cloud · Apigee

Nikita Markevich · Published 2026-05-26 · Updated 2026-05-28 · CVE-2026-2264

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Name of the Vulnerable Software and Affected Versions Google Cloud Apigee (affected versions not specified)

Description A flaw in the SetIntegrationRequest policy allows remote attackers to perform Server-Side Request Forgery (SSRF), which is a technique where an attacker forces a server to make requests to an unintended location. This can lead to the exfiltration of service account access tokens. Successful exploitation requires an administrator to have initially established an insecure configuration of the API proxy.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-2264

Affected Products

Apigee

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-2264 · Security Note
• https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins#gcp-2026-034 · Note
• https://twitter.com/TuringCyberObs/status/2059998995427025376 · Twitter Post