Compute Engine disk authorization bypass
Before the August 31 server-side fix, a user could exfiltrate disk data without the required IAM permissions.
Google discloses patched Compute Engine disk authorization and Application Integration code-execution flaws
Google’s October 26/28 bulletins disclose an IAM bypass for Compute Engine disk data and authenticated code execution in Application Integration. Both were patched server-side before disclosure; Google requests no customer update.
- Disclosed
- Oct 26, 2026
- Public disclosure date
- Severity
- Sharted
- 2 CVEs tracked here
- Splash zone
- Previously affected Compute Engine authorization and Application Integration SubWorkflow handling; authentication required
- gcp
- In the wild
- Unknown
- The bulletins do not report exploitation or a victim count.
What happened
These are separate flaws summarized from adjacent managed-service bulletins. L3 reflects cloud authorization and code-execution boundaries, not evidence that Google Cloud is currently breached.
What’s in the bowl
CVE-2026-93327SubWorkflow unsafe deserialization
Before the September 11 server-side fix, an authenticated user could submit a crafted serialized object to execute code in Application Integration.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Compute Engine | Provider patch, August 31, 2026 | |
| Application Integration | Provider patch, September 11, 2026 |
Crime-scene timeline
Aug 31, 2026
Compute Engine issue patched
Sep 11, 2026
Application Integration issue patched
Oct 26, 2026
GCP-2026-073 discloses the disk authorization flaw
Oct 28, 2026
GCP-2026-074 discloses the deserialization flaw
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Google Cloud GCP-2026-073 and GCP-2026-074PrimaryDisclosure dates, prerequisites and completed provider patches.