CVE-2026-14934CWE-862

Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise

Critical · published July 13, 2026

CVSS v4.0
9.4
EPSS
0%
Percentile
27.5
In the wild
Unconfirmed
What it is

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover.

This vulnerability was patched on 10 May 2026, and no customer action is needed.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear
EPSS
0.00351 · 27.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-13T10:20Z
EPSS history
Timeline
  • 13 JUL 10:20Z
    Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise
    cvelistv5