Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-2264

Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GoogleCloud

Description

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Google Cloud Apigee-X

Default version status: unaffected

  • 0 to < 1.14.4affected
  • 0 to < 1.15.2affected
  • 0 to < 1.16.1affected

References