What’s Vulnerable › Vulnerabilities
CVE-2026-2264: Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.
- Severity: critical (CVSS 9.2 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-26 · updated 2026-07-24
- Weakness: CWE-918
Description
A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.
Affected products
- Google Cloud Apigee-X: before 1.14.4; before 1.15.2; before 1.16.1 — fixed in 1.14.4, 1.15.2, 1.16.1
How to fix
Upgrade to a fixed version: Google Cloud Apigee-X 1.14.4, 1.15.2, 1.16.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-2264 or the next vulnerability affects your stack