GCP-2026-068 — Published: 2026-10-14Updated: 2026-11-05Description Description Severity Notes An Incorrect Authorization vulnerability in the…

Published: 2026-10-14Updated: 2026-11-05Description Description Severity Notes An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Application Integration versions prior to August 27, 2026. What should I do? No customer action to resolve this vulnerability is required. This vulnerability was patched on August 27, 2026. Application Integration helps to enhance security against authorization vulnerabilities by requiring the iam.serviceAccounts.actAs permission on the run-as service account to publish or test an integration. Integrations created on or after October 15, 2026, must have a run-as service account to publish or test scheduled or event triggers. Starting January 15, 2027 (UTC), this requirement also applies to existing integrations created before October 15, 2026. For more information, see Prepare for upcoming authorization changes. What vulnerabilities are being addressed? An authenticated user could escalate privileges and impersonate a service account in the Google Cloud project. High CVE-2026-85298