CVE-2026-8934 — Cross-Project Information Leakage in Google App Engine UI

CVE-2026-8934

Cross-Project Information Leakage in Google App Engine UI PUBLISHED

Description (CNA)

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched on 7 April 2026, and no customer action is needed.

Affected (CNA)

Vendor / product	Versions
Google Cloud / Cloud Console UIs	affected 0 before 2026-04-07

CWE

CWE-862

References

https://docs.cloud.google.com/support/bulletins#gcp-2026-038

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.