A privilege escalation vulnerability was addressed in Developer Connect. Previously, for GitLab Enterprise and Bitbucket Data Center connections, when Secret Manager secrets were retrieved, permissions were checked against the Developer Connect service agent (P4SA) credentials only. Developer Connect now validates that both the calling principal and the P4SA have the required permissions on the referenced secrets.

For instructions and more details, see the Developer Connect security bulletin.

A Missing Authorization vulnerability was discovered in repositories in BigQuery, Dataform, and Colab Enterprise.

What should I do?

No customer action is required. Google has already applied mitigations to all impacted products and services.

What vulnerabilities are being addressed?

During repository creation, an authenticated attacker could potentially escalate their permissions and perform cross-tenant repository takeover.

A virtualization vulnerability has been identified in the KVM x86 shadow paging and nested virtualization configurations. Because an attacker operating a virtual machine with nested virtualization could escape hypervisor boundary isolation to compromise the underlying physical host, any x86 virtual machine (whether nested or non-nested) hosted on an Intel-based server supporting nested virtualization is potentially exposed.

What should I do?

Google is deploying live hypervisor hotpatches across all managed Compute Engine host servers globally. No action is required for managed Compute Engine virtual machines or Google Kubernetes Engine clusters. Because remediation is performed transparently at the physical host hypervisor level, customer VM downtime, reboots, or manual upgrades are not required.

Customers operating self-managed virtualized environments or custom host hypervisors outside standard managed Compute Engine infrastructure should ensure their host Linux kernel is updated with the upstream patch as soon as it is made available by their operating system vendor.

What vulnerabilities are being addressed?

The vulnerability (CVE-2026-53359) exploits a use-after-free error in the x86 shadow paging and nested page table translation routines. Google has observed no evidence of active customer exploitation in production environments. Live patching and host-level monitoring have been implemented globally to mitigate risk and detect exploit attempts.

A vulnerability was detected in Envoy Proxy where blocked QPACK decoding can cause a Denial-of-Service Attack against the HTTP/3 stack.

For instructions and more details, see the Cloud Service Mesh security bulletin.

A vulnerability was detected in Application Integration's JavaScript task, which was using the Rhino JavaScript engine. This only impacted tasks published before January 2025.

For details and instructions, see the Application Integration security bulletin.

A vulnerability was found in Firebase Studio where the GetSignedGcsUrl RPC allowed authenticated users to list buckets and download deployment source code of other tenants.

No action is required to mitigate this vulnerability as the fix has been deployed to the backend service.

As a precautionary measure, users who stored sensitive information, such as API keys (for example, GEMINI_API_KEY), within their Firebase Studio workspace may choose to rotate these keys. For instructions, see the Firebase Studio troubleshooting guide.

A privilege escalation vulnerability was addressed in Cloud Build. Previously, for GitLab Enterprise and Bitbucket Data Center connections, when Secret Manager secrets were retrieved, permissions were checked against the Cloud Build service agent (P4SA) credentials only. Cloud Build now validates that both the calling principal and the P4SA have the required permissions on the referenced secrets.

For instructions and more details, see the Cloud Build security bulletin.

A recent security investigation was conducted regarding log4j vulnerabilities (CVE-2026-34480 and CVE-2026-34477) reported in Apigee Edge for Private Cloud. Google has determined that Apigee Edge for Private Cloud is not vulnerable to these CVEs. No customer action is required.

For more information, see the Apigee security bulletin.

A series of vulnerabilities were discovered in Envoy Proxy.

For instructions and more details, see the Cloud Service Mesh security bulletin.

A vulnerability in Cloud Logging could have allowed attackers to hijack log sink destinations by recreating the target Cloud Storage bucket in a project controlled by the attacker. This issue could have resulted in the continuous routing of sensitive logs to an unauthorized third party.

For more information, see the Google Cloud Observability security bulletin.

A vulnerability was found in App Engine where the GetDashboardAppStats GraphQL private API operation in the Google Cloud console leaked cross-tenant request logs.

No action is required. This vulnerability has been fixed.

2026-06-20 Update: Added GKE patch versions containing the fixes for Container-Optimized OS node images for minor versions 1.35 and 1.36. Patches for Ubuntu node images are still pending and in progress.

2026-06-19 Update: Added GKE patch versions containing the fixes for Container-Optimized OS node images for minor versions from 1.30 to 1.34. Patches for Ubuntu node images and for minor version 1.35 and 1.36 for Container-Optimized OS node images are in progress.

Multiple vulnerabilities have been discovered in containerd (the GKE container runtime). These vulnerabilities allow attackers with permissions to create pods to bypass Kubernetes security boundaries and perform host compromise, cache poisoning, and denial of service.

For instructions and more details, see the GKE security bulletin

ARM has announced CVE-2025-10263, an architectural issue affecting some Arm cores which lets an attacker bypass translation stages or GPT protections under certain conditions. This vulnerability lets an attacker at a lower exception level to write to memory owned by a higher exception level, thereby escalating privileges. This issue does not affect memory reads.

For more information, see the following bulletins:

• Compute Engine security bulletin

A vulnerability was found in Envoy where HTTP/2 downstream request processing allow an unauthenticated remote client to trigger excessive memory consumption, potentially resulting in OOM termination of the Envoy process and denial of service.

For instructions and more details, see the Cloud Service Mesh security bulletin.

A vulnerability was found in Apigee where the IntegrationRegion parameter in the SetIntegrationRequest policy lacks validation, allowing for Server-Side Request Forgery (SSRF) and service account token exfiltration. The issue arises when an attacker can control a flow variable used for IntegrationRegion, leading to requests being sent to an attacker-controlled host with the service account token.

A container breakout vulnerability CVE-2026-46300 has been found in the Linux kernel, known as Fragnesia. It allows an unprivileged local attacker to escalate to root on the host.

For instructions and more details, see the following bulletins:

• GKE security bulletin
• GDC software for VMware security bulletin
• GKE on AWS security bulletin
• GKE on Azure security bulletin
• GDC software for bare metal security bulletin

AMD has identified a hardware-level vulnerability in Zen 2 microarchitecture processors (including EPYC and Ryzen series) involving potential corruption within the micro-operation (OP) cache. Under specific conditions, this issue (AMD-SN-7052 / CVE-2025-54518) could lead to security boundary bypasses or unauthorized data access.
We have deployed fixes across Google infrastructure to mitigate these issues.

For more information, see the Compute Engine security bulletin.

Researchers discovered a vulnerability in AMD firmware that, due to missing protection, could allow a malicious hypervisor to execute arbitrary code on the AMD Secure Processor (ASP). This allows for the escalation of Memory Mapped I/O (MMIO) read and write permissions, which compromises the confidentiality and integrity of SEV-SNP guests.

For more information, see the Compute Engine security bulletin.

• CVE-2025-61971
• CVE-2025-61972
• CVE-2024-36315

2026-06-24 Update: Added patch versions for GKE.

2026-05-20 Update: Added CVE-2026-43500 and added CVE IDs to exploit paths.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:

• CVE-2026-43284
• CVE-2026-43500

For instructions and more details, see the following bulletins:

• GKE security bulletin
• GDC software for VMware security bulletin
• GKE on AWS security bulletin
• GKE on Azure security bulletin
• GDC software for bare metal security bulletin

Microsoft is updating the Secure Boot certificates originally issued in 2011 to ensure Windows devices continue to verify trusted boot software. These older certificates begin expiring in June 2026. Devices that haven't received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install. However, these devices will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot-level vulnerabilities. Also, Secure Boot certificate expirations starting in June 2026 affect Linux systems that use Secure Boot.

What should I do?

Google recommends that customers update their Windows VMs by taking appropriate actions as recommended by Microsoft. Distributions like Ubuntu, Red Hat, and Fedora are already working to provide updated packages signed with the new 2023 key. Refer also to the Broadcom documentation to resolve errors and warnings in VMware virtual machines as Secure Boot certificates approach expiration. After June 2026, systems lacking the 2023 certificate updates may experience failures during new operating system installations or while updating the existing bootloader firmware.

CVE-2026-31431, also known as "Copy Fail," is a high-severity local privilege escalation (LPE) vulnerability in the Linux kernel that allows an unprivileged user to gain root access. Disclosed in late April 2026, it stems from a logic flaw in the kernel's cryptographic subsystem (algif_aead) introduced in 2017.

What should I do?

Google recommends that customers protect their Linux Guest VMs by updating the kernel on all Linux VMs. Major distributions have released or are rolling out fixes.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23351

For instructions and more details, see the following bulletins:

• GKE security bulletin
• GDC software for VMware security bulletin
• GKE on AWS security bulletin
• GKE on Azure security bulletin
• GDC software for bare metal security bulletin

2026-05-04 Update: Added patch versions for GKE.

A vulnerability in the Linux kernel (CVE-2026-31431) allows an unprivileged local attacker to write to the system page cache, potentially leading to local privilege escalation and container escape.

For instructions and more details, see the following bulletins:

• GKE security bulletin
• GDC software for VMware security bulletin
• GKE on AWS security bulletin
• GKE on Azure security bulletin
• GDC software for bare metal security bulletin

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23274

For instructions and more details, see the following bulletins:

• GKE security bulletin
• GDC software for VMware security bulletin
• GKE on AWS security bulletin
• GKE on Azure security bulletin
• GDC software for bare metal security bulletin

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:

• CVE-2025-38248

For instructions and more details, see the following bulletins:

• GKE security bulletin
• GDC software for VMware security bulletin
• GKE on AWS security bulletin
• GKE on Azure security bulletin
• GDC software for bare metal security bulletin

2026-05-07 Update: Added patch versions for Ubuntu node pools on GKE

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23074

For instructions and more details, see the following bulletins:

• GKE security bulletin
• GDC software for VMware security bulletin
• GKE on AWS security bulletin
• GKE on Azure security bulletin
• GDC software for bare metal security bulletin

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23209

For instructions and more details, see the following bulletins:

• GKE security bulletin
• GDC software for VMware security bulletin
• GKE on AWS security bulletin
• GKE on Azure security bulletin
• GDC software for bare metal security bulletin

AMD reported a vulnerability in its firmware that could have allowed a malicious hypervisor to direct the IOMMU to write into the guest memory of AMD SEV-SNP enabled instances, compromising guest data integrity. Google rolled out a mitigation to vulnerable Confidential VM instances with AMD SEV-SNP enabled.

What should I do?

No customer action is needed. The mitigation has already been applied to Confidential VM instances with AMD SEV-SNP enabled.

For more information, see AMD advisory AMD-SB-3016.

CVE-2023-20585

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23231

For instructions and more details, see the following bulletins:

• GKE security bulletin
• GDC software for VMware security bulletin
• GKE on AWS security bulletin
• GKE on Azure security bulletin
• GDC software for bare metal security bulletin

Researchers discovered a vulnerability in AMD firmware that could allow a malicious hypervisor to alter BIOS settings and Memory Mapped I/O (MMIO) routing configurations, compromising the confidentiality and integrity of Confidential VMs with AMD SEV-SNP guests.

For more information, see the Compute Engine security bulletin.