CVE-2026-8934: Google Cloud Cloud Console Uis

Medium severity, CVSS 6.9. EPSS: 0.5% chance of exploitation in the next 30 days.

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched on 7 April 2026, and no customer action is needed.

Affected products

• Google Cloud Cloud Console Uis: before 2026-04-07 (fixed in 2026-04-07)

Published 2026-06-22. Last modified 2026-06-22.