CVE-2026-85299
Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August 2026, and no customer action is needed.
| CWE | CWE-862 |
| Vendor | google cloud |
| Product | compute engine |
| Published | Oct 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for google cloud compute engine
Be the first to know when new unknown vulnerabilities affecting google cloud compute engine are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Google Cloud / Compute Engine
0 < 2026-08-31
References
Credits
🔍 Parsa Babadiaghakhanpour