CVE-2026-12879

MediumCVSS 5.9

Published: 09/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Summary

An Improper Input Validation vulnerability in the BigQuery DAO component of Google Cloud Apigee (versions prior to 2026-06-12) allows an authenticated attacker to exfiltrate cross-tenant data. The vulnerability was patched on June 12, 2026 on the Apigee servers.

Risk Assessment

The organization is at risk of sensitive data stored in BigQuery being leaked to other tenants in Google Cloud, potentially leading to confidentiality breaches and regulatory non-compliance.

Recommendation

No customer action is required as the fix was applied automatically by Google Cloud. However, it is recommended to verify that the Apigee environment is running the latest version.

Other vulnerabilities in Google Cloud Apigee

CVE-2026-2264Critical
Vulnerability in Google Cloud Apigee SetIntegrationRequest policy allows SSRF and theft of service account tokens. Requires insecure proxy configuration by an administrator.

Original NVD description (English source)

An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data. This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS