HighVulnerability
CVE-2026-19486: A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-19486
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
A Server-Side Request Forgery (SSRF) flaw in Google Cloud Gemini Enterprise Agent Platform App Builder, in versions prior to 2026-06-01 on Google Cloud Platform, lets an unauthenticated attacker leak the Compute Engine default service account access token. The vulnerability was identified as CVE-2026-19486.
Mitigation
This vulnerability was patched on 01 June 2026. Users will need to redeploy their previously deployed apps.
Related items
- MediumCVE-2026-111372: AI ChatBot for WooCommerce WoowBot plugin authorization bypass in RAG syncSame vendor · NVD/CVE Database
- HighCVE-2026-117560: ATXP Gemini CLI extension OS command injection in runAtxp() via MCP parametersSame vendor · NVD/CVE Database
- CriticalCVE-2026-90970: GitLab AI Gateway prompt template sandbox escape via crafted flow configurationSame vendor · NVD/CVE Database
- MediumCVE-2026-89278: GPTranslate WordPress plugin exposes plaintext API key to unauthenticated usersSame vendor · NVD/CVE Database
- CriticalCVE-2026-19407: Google Cloud Gemini Enterprise Agent Platform SDK for Python bucket squattingSame vendor · NVD/CVE Database