What is GHSA-m9g6-pjc8-qxfr?

GHSA-m9g6-pjc8-qxfr is a security advisory published by GitHub Security Advisories with High severity. A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent...

Which CVE IDs does GHSA-m9g6-pjc8-qxfr cover?

GHSA-m9g6-pjc8-qxfr covers the following CVE IDs: CVE-2026-19486. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-m9g6-pjc8-qxfrHigh

A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent...

Vendor

GitHub Security Advisories

Published

September 11, 2026

Last Modified

September 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-19486 →

📋 Description

A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token.

This vulnerability was patched on 01 June 2026. Users will need to redeploy their previously deployed apps.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-19486
https://docs.cloud.google.com/gemini-enterprise-agent-platform/release-notes#July_20_2026
https://github.com/advisories/GHSA-m9g6-pjc8-qxfr