VulnSocial

CVE-2026-19410Disclosure

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and no customer action is needed.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-345CWE-367

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked 3d ago at 1 mentions (2026-08-31); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-08-31: 1Mentions · 2026-09-01: 1Mentions · 2026-09-04: 1Mentions · 2026-09-05: 1Patch / Workaround · 2026-08-31: 1Patch / Workaround · 2026-09-04: 1Patch / Workaround · 2026-09-05: 1Technical Details · 2026-08-31: 1Technical Details · 2026-09-01: 1Technical Details · 2026-09-04: 1Technical Details · 2026-09-05: 108-3109-0109-0409-05
Signal classification2 categories
Disclosure
250.0%
Patch
250.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-08-311
Disclosure1
2026-09-011
Disclosure1
2026-09-041
Patch1
2026-09-051
Patch1
Full discourse4 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-19410 An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker… https://www.cve.org/CVERecord?id=CVE-2026-19410

    Post summary

    The post announces CVE-2026-19410, describing an Incorrect Authorization issue in GitHub Trigger Comment Control for Google Cloud Build, but does not provide exploits, patches, or evidence of active attacks.

    000101.8K
    58.0K followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    Patch

    【重要】Google Cloud BuildにCVSS 9.4、認可不備を修正 https://www.cybernote.click/2026/08/31/google-cloud-build-cve-2026-19410-comment-control-bypass/ #IT #Security #cybersecurity

    Post summary

    A critical CVE (CVE‑2026‑19410) impacting Google Cloud Build’s authorization logic has been patched; the post highlights a high CVSS score and a fix, but does not provide PoCs, exploits, or claims of active attacks.

    0000043
    206 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    Patch

    【重要】Google Cloud BuildにCVSS 9.4、認可不備を修正 https://www.cybernote.click/2026/08/31/google-cloud-build-cve-2026-19410-comment-control-bypass/ #IT #Security #cybersecurity

    Post summary

    The notice confirms that Google Cloud Build’s CVE‑2026‑19410, rated CVSS 9.4, has been addressed with a patch, with no indication of active exploitation or PoC.

    0000023
    206 followersView on X
  • CyberSignal | Cybersecurity & AI News@XQOPTRX
    Disclosure

    🚨 CRITICAL CLOUD SECURITY — Google disclosed a CVSS 9.4 flaw today that could let an attacker turn a GitHub comment into UNREVIEWED CODE execution inside Cloud Build. CVE-2026-19410 is already patched by Google. But the attack model is worth understanding. Thread ↓ 1/ CVE-2026-19410 affects: Google Cloud Build + GitHub Trigger Comment Control. Severity: CVSS v4.0 — **9.4 CRITICAL** Published: August 31, 2026. 2/ Cloud Build can connect GitHub activity to CI/CD pipelines. That means events such as: repository changes pull requests comments can influence automated build workflows. That automation is powerful. And therefore dangerous when authorization boundaries fail. 3/ The vulnerability involved: **webhook suppression + incorrect authorization.** According to Google's CVE description, a remote attacker could potentially cause: unreviewed code to execute inside: the build environment. 4/ Simplified chain: Attacker interacts with GitHub workflow ↓ Trigger/comment authorization logic reached ↓ Webhook/control behavior manipulated ↓ Expected review boundary bypassed ↓ Unreviewed code enters build workflow ↓ Cloud Build executes it. CI/CD therefore becomes the execution environment. 5/ Why this matters: Build systems often hold extremely valuable privileges. Potential assets include: cloud service accounts artifact registries deployment credentials container registries source code signing infrastructure production deployment permissions. A build-system compromise can become a: **software supply-chain compromise.** 6/ This is why CI/CD is increasingly Tier-0 infrastructure. If an attacker compromises one workstation: one developer may be affected. If an attacker compromises the build pipeline: every artifact produced AFTER the compromise may become questionable. 7/ Good news: Google says the vulnerability was patched on: **June 24, 2026** and: **no customer action is required.** Today's development is the public CVE disclosure. 8/ Important caveat: This does NOT mean attackers are currently exploiting Google Cloud Build customers. The public CVE does not establish active exploitation. And because Cloud Build is a managed service, Google already applied the remediation. 9/ CyberSignal insight: The most dangerous code in a software company may not be the code developers write. It may be the automation deciding WHICH code is allowed to reach production. Sources: Google Cloud · MITRE · NVD

    Post summary

    Google has publicly disclosed CVE-2026-19410, a 9.4‑severity flaw that could allow unreviewed code execution in Cloud Build via GitHub comment triggers; it is already patched and requires no customer action.

    0000061
    182 followersView on X

Explore more

Back to dashboard