CVE-2026-85297High· 7.7▾ TwilightBucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.
Users must upgrade to Cloud Run MCP version 1.11.0 or later.
cloud_run_mcp < 1.11.0Users must upgrade to Cloud Run MCP version 1.11.0 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93328Critical· 9.3Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
CVE-2026-85267High· 8.7Cross-Site WebSocket Hijacking in Google Cloud Shell
CVE-2026-85298High· 7.3An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and imperson…
CVE-2026-19759Critical· 9.4An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs…
CVE-2026-81867Critical· 9.4A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrar…
CVE-2026-81375High· 8.3A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal fi…