{"data":{"id":"40e3bae2-e794-4c36-b9e3-324c1025fa2d","title":"CVE-2026-19486: A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions","summary":"A Server-Side Request Forgery vulnerability (SSRF, where an attacker tricks a server into making requests to internal systems it shouldn't access) exists in Google Cloud Gemini Enterprise Agent Platform App Builder versions before June 1, 2026. An attacker without authentication can exploit this to steal the Compute Engine default service account access token (a credential that grants permissions to cloud resources). The vulnerability was patched on June 1, 2026.","solution":"Users will need to redeploy their previously deployed apps to receive the patch.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19486","publishedAt":"2026-09-11T09:17:20.327Z","cveId":"CVE-2026-19486","cweIds":["CWE-918"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Google"],"affectedVendorsRaw":["Google Cloud","Google Cloud Gemini","Google Cloud Platform","Gemini Enterprise Agent Platform"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-09-11T09:17:20.327Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":["AML.T0010"]}}