CVE-2026-4764: Google Cloud Dialogflow Cx

Critical severity, CVSS 9.4. EPSS: 0.4% chance of exploitation in the next 30 days.

A Missing Authorization vulnerability in the playbook import functionality in Dialogflow CX on Google Cloud Platform allows an authenticated user with specific roles to escalate privileges and potentially take over a GCP project using a maliciously crafted playbook import. This vulnerability was patched on 15 March 2026, and no customer action is needed.

Affected products

• Google Cloud Dialogflow Cx: before 2026-03-15 (fixed in 2026-03-15)

Published 2026-06-11. Last modified 2026-06-17.