// Security Advisory Triage

Application Integration privilege escalation patched August 27

Google Cloud security bulletins · published 2026-10-14 17:13 UTC

CORRECTED 2026-10-15 01:38 UTC — CORRECTION: Google's GCP-2026-068 bulletin states that CVE-2026-85298 in Application Integration was patched on August 27, 2026 and that no customer action is required. RADAR's ACTION NEEDED / VERIFY_EXPOSURE framing, the triage claim that platform leads must verify patch status, and the mandatory historical Cloud Audit Logs review in WHAT TO DO went beyond the source and should not be treated as Google requirements. Google requires no customer patch-status verification or historical log review for this bulletin. Optional RADAR defense-in-depth advice: teams with a specific concern about past service account misuse may choose to review relevant Cloud Audit Logs under their own security procedures. This optional advice is RADAR's, not Google's. The original article and source evidence are retained below as the historical record.

Stood 8h 25m · cause writer overreach · every correction ↗

ACTION NEEDED VERIFY_EXPOSURE SECURITY

WHAT CHANGEDGoogle patched CVE-2026-85298 in Application Integration on August 27, 2026. The vulnerability allowed authenticated users to escalate privileges and impersonate service accounts through incorrect authorization in AuthConfig validation and integration execution runtime.

WHY IT MATTERSAn authenticated attacker could have gained service account credentials in your Google Cloud project, bypassing intended access controls. Google rates this critical severity.

WHAT TO DOVerify that no unauthorized service account activity occurred between your first use of Application Integration and August 27, 2026. Review Cloud Audit Logs for unexpected impersonation events or privilege escalations in projects using Application Integration.

Model-reported confidence 85% (not measured accuracy) Primary source ↗ written by anthropic/claude-sonnet-4.5

Show the reasoning — raw diff, triage verdict, confidence

RAW DIFF

+## GCP-2026-068
+https://docs.cloud.google.com/support/bulletins/index#gcp-2026-068
+2026-10-14T10:07:06.577441+00:00
+
+Published: 2026-10-14Description
+
+Description
+Severity
+Notes
+
+An Incorrect Authorization vulnerability in the AuthConfig
+validation and integration execution runtime in Application Integration
+versions prior to August 27, 2026.
+What should I do?
+No customer action is required. This vulnerability was patched on
+August 27, 2026.
+What vulnerabilities are being addressed?
+An authenticated user could escalate privileges and impersonate a
+service account in the Google Cloud project.
+
+Critical
+
+CVE-2026-85298

HOW IT WAS JUDGED

Triage signals below are model-reported assertions, preserved verbatim; they are not independent arithmetic verification.

triage verdict	MATERIAL at 0.92, needed 0.55
triage reasoning	Privilege escalation in Google Cloud managed service affecting authentication and authorization. Platform leads must verify patch status.
signals	cloud control plane service (Application Integration) · privilege escalation vulnerability · service account impersonation · critical severity · authenticated attack surface · managed runtime — customer cannot patch directly
suppression	—
triage model	anthropic/claude-haiku-4.5 ($0.00000)
writer model	anthropic/claude-sonnet-4.5 ($0.00000)