CVE-2026-2264

CriticalCVSS 9.2

Published: 26/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

Vulnerability in Google Cloud Apigee SetIntegrationRequest policy allows SSRF and theft of service account tokens. Requires insecure proxy configuration by an administrator.

Risk Assessment

An attacker can access internal sensitive resources and steal tokens, potentially leading to privilege escalation in the cloud.

Recommendation

Review and secure the API proxy configuration and update Apigee to a patched version.

Original NVD description (English source)

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.