CVE-2026-3136CWE-863

Google Cloud Build Comment Control Bypass

High · published March 3, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrary code in the build environment.

This vulnerability was patched on 26 January 2026, and no customer action is needed.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Clear
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-03T16:22Z
EPSS history
Timeline
  • 03 MAR 16:22Z
    Google Cloud Build Comment Control Bypass
    cvelistv5