Vulnerability details
CVE-2026-14934
Google Cloud BigQueryGoogle Cloud Colab EnterpriseGoogle Cloud Dataform
Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise
CVSS 4.0
9.4Critical
Official description
A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. This vulnerability was patched on 10 May 2026, and no customer action is needed.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (GoogleCloud) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Google Cloud | BigQuery | 2025-10 ≤ v < 2026-05-10 | CVEProject cvelistV5 (CNA) |
| Google Cloud | Colab Enterprise | 2025-10 ≤ v < 2026-05-10 | CVEProject cvelistV5 (CNA) |
| Google Cloud | Dataform | 2025-10 ≤ v < 2026-05-10 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-13
- Last updated
- 2026-07-13
- State
- Published
- Assigner (CNA)
- GoogleCloud
Exploit prediction (EPSS)
0.35%
Probability of exploitation in 30 days
28.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-862Missing Authorization