CVE-2026-2264

Description

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.

References

• https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins#gcp-2026-034