CVE-2026-14934 — Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise

CVE-2026-14934

Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise PUBLISHED

Description (CNA)

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. This vulnerability was patched on 10 May 2026, and no customer action is needed.

Affected (CNA)

Vendor / product	Versions
Google Cloud / BigQuery	affected 2025-10 before 2026-05-10
Google Cloud / Dataform	affected 2025-10 before 2026-05-10
Google Cloud / Colab Enterprise	affected 2025-10 before 2026-05-10

CWE

CWE-862

References

https://docs.cloud.google.com/support/bulletins#gcp-2026-047

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.