CVE-2026-85299
CVE-2026-85299 · Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August 2026, and no customer action is needed.
CVSS 8.3 · Alta · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
compute engine
- Versiones
- ≥ 0, < 2026-08-31: Afectada (date)
Actualiza a 2026-08-31