CVE-2026-85299EUVD-2026-110641GHSA-3V73-7MVH-2MH5
Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2026-08-31
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Google Compute Engine, specifically its disk snapshot APIs on Google Cloud Platform, is affected by this vulnerability. An authenticated attacker could use it to copy and access disk data belonging to other projects, which exposes data that should have been restricted.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August 2026, and no customer action is needed.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Google Cloud Compute Engine
fixed in 2026-08-31