CVE-2026-12717
CriticalCVSS 9.4Summary
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in the tenant project using crafted JDBC connection string parameters. This vulnerability was patched on 1 May 2026, and no customer action is needed.
Risk Assessment
An authenticated attacker can execute arbitrary code in the connector container and escalate privileges in the project, potentially leading to data and resource compromise in the cloud.
Recommendation
No customer action is needed as the patch has already been applied by Google Cloud. Ensure the service uses the latest version.
Original NVD description (English source)
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in the tenant project using crafted JDBC connection string parameters. This vulnerability was patched on 1 May 2026, and no customer action is needed.