Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-12879 EUVD-2026-42584GHSA-974p-4xqx-2m2q

Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy

Published Jul 9, 2026 · Updated Jul 9, 2026 · Assigned by GoogleCloud

Description

An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data.

This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed.

Affected products

VendorProductAffectedFixed
Google Cloud Apigee < 2026-06-12 2026-06-12

References