CVE-2026-2264CWE-918

Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.

Critical · published May 26, 2026

CVSS v4.0
9.2
EPSS
0%
Percentile
28.5
In the wild
Unconfirmed
What it is

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens.

For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber
EPSS
0.00360 · 28.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-26T16:30Z
EPSS history
Timeline
  • 26 MAY 16:30Z
    Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.
    cvelistv5