CVE-2026-19410CWE-345CWE-367

CVE-2026-19410

published August 31, 2026

CVSS
9.4
EPSS
0%
Percentile
3.3
In the wild
Unconfirmed
What it is

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression.

This vulnerability was patched on 24 June 2026, and no customer action is needed.

The record
Technical detail
CVSS
9.4 · NONE
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear
EPSS
0.00143 · 3.3th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-08-31T13:17Z
References (1)
https://docs.cloud.google.com/build/docs/release-notes#August_24_2026 · f45cbf4e-4146-4068-b7e1-655ffc2c548c
EPSS history
Timeline
  • 01 SEP 03:29Z
    EPSS moved — → 0%
    epss
  • 31 AUG 08:14Z
    Google Cloud Build Comment Control Bypass via Webhook Suppression
    cvelistv5