Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-14934

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. This vulnerability was patched on 10 May 2026, and no customer action is needed.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:625ad70a17b3ba13068532770cf84bdb90463463ca043b92d5e50226b97daa86
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 3 assertions

{"defaultStatus":"unaffected","product":"BigQuery","vendor":"Google Cloud","versions":[{"lessThan":"2026-05-10","status":"affected","version":"2025-10","versionType":"date"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0fde3c8e98b7433a89f8f561905fd4fbbd71f901e8537865ed5de136e6e1947c · sha256:bde4b5d797c73eb8… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"Dataform","vendor":"Google Cloud","versions":[{"lessThan":"2026-05-10","status":"affected","version":"2025-10","versionType":"date"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0fde3c8e98b7433a89f8f561905fd4fbbd71f901e8537865ed5de136e6e1947c · sha256:bde4b5d797c73eb8… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Colab Enterprise","vendor":"Google Cloud","versions":[{"lessThan":"2026-05-10","status":"affected","version":"2025-10","versionType":"date"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0fde3c8e98b7433a89f8f561905fd4fbbd71f901e8537865ed5de136e6e1947c · sha256:bde4b5d797c73eb8… · /containers/cna/affected/2

Affected products and versions

3 source assertions
{"defaultStatus":"unaffected","product":"BigQuery","vendor":"Google Cloud","versions":[{"lessThan":"2026-05-10","status":"affected","version":"2025-10","versionType":"date"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0fde3c8e98b7433a89f8f561905fd4fbbd71f901e8537865ed5de136e6e1947c · sha256:bde4b5d797c73eb8… · /containers/cna/affected/0
{"defaultStatus":"unaffected","product":"Dataform","vendor":"Google Cloud","versions":[{"lessThan":"2026-05-10","status":"affected","version":"2025-10","versionType":"date"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0fde3c8e98b7433a89f8f561905fd4fbbd71f901e8537865ed5de136e6e1947c · sha256:bde4b5d797c73eb8… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Colab Enterprise","vendor":"Google Cloud","versions":[{"lessThan":"2026-05-10","status":"affected","version":"2025-10","versionType":"date"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0fde3c8e98b7433a89f8f561905fd4fbbd71f901e8537865ed5de136e6e1947c · sha256:bde4b5d797c73eb8… · /containers/cna/affected/2

Provider-owned CVSS observations

1 source assertion
{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.4,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"CLEAR","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpa…
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:0fde3c8e98b7433a89f8f561905fd4fbbd71f901e8537865ed5de136e6e1947c · sha256:bde4b5d797c73eb8… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:0fde3c8e98b7433a89f8f561905fd4fbbd71f901e8537865ed5de136e6e1947c · sha256:bde4b5d797c73eb8… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"url":"https://docs.cloud.google.com/support/bulletins#gcp-2026-047"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0fde3c8e98b7433a89f8f561905fd4fbbd71f901e8537865ed5de136e6e1947c · sha256:bde4b5d797c73eb8… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer