What is GCP-2026-042?

GCP-2026-042 is a security advisory published by Google Cloud Security Bulletins with Low severity. GCP-2026-042 — Published: 2026-06-24Description Description Severity Notes A privilege escalation vulnerability was addressed in Cloud Build.

Why does GCP-2026-042 have no CVE ID yet?

Google Cloud Security Bulletins published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

GCP-2026-042LowDisclosed before NVD

GCP-2026-042 — Published: 2026-06-24Description Description Severity Notes A privilege escalation vulnerability was addressed in Cloud Build.

Vendor

Google Cloud Security Bulletins

Published

June 24, 2026

Last Modified

—

📋 Description

Published: 2026-06-24Description Description Severity Notes A privilege escalation vulnerability was addressed in Cloud Build. Previously, for GitLab Enterprise and Bitbucket Data Center connections, when Secret Manager secrets were retrieved, permissions were checked against the Cloud Build service agent (P4SA) credentials only. Cloud Build now validates that both the calling principal and the P4SA have the required permissions on the referenced secrets. For instructions and more details, see the Cloud Build security bulletin. Low

🔗 References (1)

advisoryhttps://docs.cloud.google.com/support/bulletins/index#gcp-2026-042