CVE-2026-14934
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A missing authorization vulnerability in the repository creation functionality of Google Cloud BigQuery, Dataform, and Colab Enterprise allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. The vulnerability affects versions between October 2025 and May 10, 2026.
Risk Assessment
An attacker can take over repositories of other tenants in Google Cloud, leading to confidentiality and integrity breaches and potential full project takeover.
Recommendation
No customer action is required as the patch was applied on May 10, 2026. Ensure that the latest versions of the services are in use.
Original NVD description (English source)
A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. This vulnerability was patched on 10 May 2026, and no customer action is needed.