Why does GCP-2026-039 have no CVE ID yet?

Google Cloud Security Bulletins published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

GCP-2026-039MediumDisclosed before NVD

GCP-2026-039 — Published: 2026-06-22Description Description Severity Notes A vulnerability in Cloud Logging could have allowed attackers to hijack log…

Vendor

Google Cloud Security Bulletins

Published

June 22, 2026

Last Modified

—

📋 Description

Published: 2026-06-22Description Description Severity Notes A vulnerability in Cloud Logging could have allowed attackers to hijack log sink destinations by recreating the target Cloud Storage bucket in a project controlled by the attacker. This issue could have resulted in the continuous routing of sensitive logs to an unauthorized third party. For more information, see the Google Cloud Observability security bulletin. Medium

🔗 References (1)

advisoryhttps://docs.cloud.google.com/support/bulletins/index#gcp-2026-039