CVE-2026-12879 Details
Description
An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data. This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed.
A vulnerability allowing improper input validation has been identified in the BigQuery DAO component of Google Cloud Apigee, affecting versions prior to 2026-06-12. This vulnerability allows authenticated attackers to exfiltrate cross-tenant data. The issue has been patched on the Apigee servers, and no action is required from customers.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cloud.google.com/apigee/docs/release-notes#July_08_2026 | GoogleCloud |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | GoogleCloud |
| CWE-610 | Externally Controlled Reference to a Resource in Another Sphere | GoogleCloud |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | GoogleCloud |