CVE-2026-19759 Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
Authenticated users can execute arbitrary internal RPCs with privileged identity due to incorrect authorization in task configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19759?
CVE-2026-19759 is a critical missing authorization vulnerability in Google Cloud Application Integration, published on 28 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type.
This vulnerability was patched on 17 June 2026, and no customer action is needed.
Weakness: CWE-863
Which versions are affected by CVE-2026-19759?
How do I fix CVE-2026-19759?
No fix has been published for CVE-2026-19759 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-19759 being exploited?
There is no known exploitation of CVE-2026-19759 in the wild and no public exploit code.
Sources
Also known as GHSA-hwqr-vwwq-mq54.