Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrary code in the build environment. This vulnerability was patched on 26 January 2026, and no customer action is needed.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-3136 Remote Code Execution in Google Cloud Build via GitHub Trigger Comment Control https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3136
Post summary
A new RCE vulnerability (CVE-2026-3136) affecting Google Cloud Build via GitHub trigger comment control has been disclosed.
Cloud Build update on March 03, 2026 https://docs.cloud.google.com/build/docs/release-notes/#March_03_2026 #googlecloud Fixed The authorization vulnerability CVE-2026-3136 was fixed.
Post summary
Google Cloud Build released a patch fixing the authorization vulnerability CVE-2026-3136.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cloud_build | - | - | - |