Google Cloud Application Integration Improper Access Control Vulnerability Allowing Information Disclosure and Arbitrary Code Execution

A vulnerability has been identified in several internal API endpoints for Google Cloud Application Integration, prior to January 23, 2026. This vulnerability allows remote, unauthenticated attackers to disclose sensitive internal information and execute arbitrary code. The issue arises from improper access control on inadvertently exposed internal API endpoints, which can be exploited using specially crafted HTTP requests.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive internal information and the execution of arbitrary code on the server.

Remediation

This vulnerability has been addressed by restricting access to the exposed API endpoints. No action is required from users, as the necessary fixes have been automatically deployed to Gemini Enterprise.