CVE-2026-2264 — Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.

CVE-2026-2264

Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy. PUBLISHED

Description (CNA)

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.

Affected (CNA)

Vendor / product	Versions
Google Cloud / Apigee-X	affected 0 before 1.14.4; affected 0 before 1.15.2; affected 0 before 1.16.1

CWE

CWE-918

References

https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins#gcp-2026-034

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.