CVE-2026-81375

Published: Set 28, 2026 Last Modified: Set 28, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,3
Source: f45cbf4e-4146-4068-b7e1-655ffc2c548c
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path.

This vulnerability was patched on 30 June 2026, and no customer action is needed.

610

Externally Controlled Reference to a Resource in Another Sphere

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Access Control
Potential Impacts:
Read Application Data Modify Application Data Gain Privileges Or Assume Identity
Applicable Platforms
All platforms may be affected
View CWE Details
https://docs.cloud.google.com/application-integration/docs/…
https://docs.cloud.google.com/application-integration/docs/security-bulletins#g…
https://docs.cloud.google.com/support/bulletins#gcp-2026-066
https://docs.cloud.google.com/support/bulletins#gcp-2026-066