CVE-2026-3136 — Google Cloud Build Comment Control Bypass

CVE-2026-3136

Google Cloud Build Comment Control Bypass PUBLISHED

Description (CNA)

An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrary code in the build environment. This vulnerability was patched on 26 January 2026, and no customer action is needed.

Affected (CNA)

Vendor / product	Versions
Google Cloud / Cloud Build	affected 0 before 1/26/2026

CWE

CWE-863

References

https://docs.cloud.google.com/build/docs/release-notes#March_03_2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.