CVE-2026-19759
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2026-06-17
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type. This vulnerability was patched on 17 June 2026, and no customer action is needed.
Affected versions
- Google Cloud Application Integration
fixed in 2026-06-17