Why does GCP-2026-009 have no CVE ID yet?

Google Cloud Security Bulletins published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

GCP-2026-009HighDisclosed before NVD

GCP-2026-009 — Published: 2026-02-13Description Description Severity Notes Observability Analytics user interface versions prior to January 2026 can be…

Vendor

Google Cloud Security Bulletins

Published

May 20, 2026

Last Modified

—

📋 Description

Published: 2026-02-13Description Description Severity Notes Observability Analytics user interface versions prior to January 2026 can be configured to automatically execute SQL queries. A vulnerability can allow an attacker to craft a query URL which, when opened by someone with credentials, could access table contents or incur query cost. For more information, see the Google Cloud Observability security bulletin. High

🔗 References (1)

advisoryhttps://docs.cloud.google.com/support/bulletins/index#gcp-2026-009