CVE-2026-4644 in Integration Connectors
Summary
by MITRE • 09/04/2026
A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment.
This vulnerability was patched on 11 December 2025, and no customer action is needed.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The identified security flaw resides within the HTTP Connector component of Google Cloud Integration Connectors, specifically affecting versions released prior to the patch date of December 11, 2025. This vulnerability represents a critical failure in access control mechanisms, classified under CWE-862 as Missing Authorization. The core technical issue stems from an insufficient validation of user permissions when handling requests related to service account attachments within integration workflows. In a properly secured system, any operation that modifies the association between a Google Cloud Project and a specific service account must verify that the initiating authenticated user possesses explicit administrative privileges for both the project and the target identity resource. However, in the vulnerable versions, this verification step is bypassed or incorrectly implemented, allowing an attacker with standard authenticated access to perform actions reserved exclusively for organization administrators or project owners.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and account takeover. An adversary who has obtained valid credentials for a lower-privileged user can exploit the missing authorization check to attach unauthorized service accounts to Google Cloud Projects under their control or influence. By attaching a service account that they also control, the attacker effectively gains the permissions associated with that service account within the context of the targeted project. This mechanism allows the adversary to bypass standard IAM policies and execute operations as if they were an administrator, leading to full compromise of the affected Google Cloud Project. Such unauthorized access can result in data exfiltration, deployment of malicious workloads, lateral movement across cloud resources, and potential disruption of business-critical services hosted on the platform.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1098.004, which describes SSH Authorized Key Manipulation in the context of cloud environments, or more broadly T1078 Valid Accounts when combined with credential theft to gain initial access followed by privilege escalation via misconfigured permissions. The attack vector is primarily remote and requires authentication, placing it within the category of authenticated attacks that exploit logical flaws rather than code execution vulnerabilities. This distinction highlights that traditional perimeter defenses such as firewalls or intrusion detection systems may not detect this activity if the attacker uses legitimate credentials to interact with the API endpoints governing integration connectors.
Mitigation for this vulnerability was addressed in the release dated December 11, 2025. Google has confirmed that no manual action is required from customers who have enabled automatic updates or are using managed services where patching occurs transparently. However, organizations utilizing self-managed instances of Integration Connectors must ensure their environments are updated to version 2025-12-11 or later immediately upon availability. For those relying on automated deployment pipelines, it is advisable to verify that the container images or package repositories reflect this patched version before proceeding with any new deployments. Additionally, security teams should audit recent IAM policy changes and service account attachments for anomalies in environments where older versions were active between the vulnerability disclosure date and the patch release. Implementing strict least-privilege principles and monitoring API calls related to resource attachment operations can provide an additional layer of defense against similar logical access control flaws in cloud infrastructure management tools.