A critical authorization flaw in Google Cloud Build enables remote code execution within build environments, though the vendor has already applied a server-side patch.

The vulnerability involves incorrect authorization and insufficient verification of data authenticity (CWE-345) within the GitHub Trigger Comment Control mechanism. A low-privilege attacker can exploit this to execute arbitrary code by manipulating webhook suppression, effectively bypassing intended security controls.

The ability for an unauthorized party to execute code within a build environment presents a severe risk to software supply chain integrity. Successful exploitation could lead to the injection of malicious code into downstream products, resulting in widespread data compromise or system-wide unauthorized access. With a CVSS score of 9.4, this vulnerability represents a critical risk to operational security and organizational reputation.

Immediate Action: No customer action is required as Google has deployed a server-side patch to address this issue as of June 24, 2026.

Proactive Monitoring: Security teams should review historical access logs from the period prior to June 24, 2026, to identify any anomalous webhook activity or unauthorized build triggers.

Compensating Controls: Organizations should enforce strict branch protection rules and require multiple approvals for all pull requests to ensure that build triggers remain under authorized control.

Public Exploit Available: No (exploit_available: false).

While this vulnerability has been remediated by Google, the high severity of the flaw highlights the importance of maintaining rigorous oversight of CI/CD pipeline configurations. Organizations should verify that their cloud environment settings are consistent with current security best practices and continue to monitor CI/CD logs for any signs of unauthorized configuration changes or unexpected build activity.