CVE-2026-19486: SSRF in Gemini Enterprise Agent Platform App Builder

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-11 · updated 2026-09-11
Weakness: CWE-918

Description

A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on 01 June 2026. Users will need to redeploy their previously deployed apps.

Affected products

Google Cloud Gemini Enterprise Agent Platform App Builder: from 2025-10-11 before 2026-06-01 — fixed in 2026-06-01

How to fix

Upgrade to a fixed version: Google Cloud Gemini Enterprise Agent Platform App Builder 2026-06-01. Check the vendor advisory for mitigations.

References

https://docs.cloud.google.com/gemini-enterprise-agent-platform/release-notes#July_20_2026

Get alerted when CVE-2026-19486 or the next vulnerability affects your stack