Why does GCP-2026-005 have no CVE ID yet?

Google Cloud Security Bulletins published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

GCP-2026-005HighDisclosed before NVD

GCP-2026-005 — Published: 2026-01-28Description Description Severity Notes This vulnerability affects Log Analytics interface and Cloud Monitoring…

Vendor

Google Cloud Security Bulletins

Published

May 20, 2026

Last Modified

—

📋 Description

Published: 2026-01-28Description Description Severity Notes This vulnerability affects Log Analytics interface and Cloud Monitoring dashboarding interface versions prior to January 2026. For more information, see the Google Cloud Observability security bulletin. High

🔗 References (1)

advisoryhttps://docs.cloud.google.com/support/bulletins/index#gcp-2026-005