What is GCP-2026-048?

GCP-2026-048 is a security advisory published by Google Cloud Security Bulletins with Medium severity. GCP-2026-048 — Published: 2026-07-13Description Description Severity Notes A privilege escalation vulnerability was addressed in Developer Connect.

Why does GCP-2026-048 have no CVE ID yet?

Google Cloud Security Bulletins published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

GCP-2026-048MediumDisclosed before NVD

GCP-2026-048 — Published: 2026-07-13Description Description Severity Notes A privilege escalation vulnerability was addressed in Developer Connect.

Vendor

Google Cloud Security Bulletins

Published

July 13, 2026

Last Modified

—

📋 Description

Published: 2026-07-13Description Description Severity Notes A privilege escalation vulnerability was addressed in Developer Connect. Previously, for GitLab Enterprise and Bitbucket Data Center connections, when Secret Manager secrets were retrieved, permissions were checked against the Developer Connect service agent (P4SA) credentials only. Developer Connect now validates that both the calling principal and the P4SA have the required permissions on the referenced secrets. For instructions and more details, see the Developer Connect security bulletin. Medium

🔗 References (1)

advisoryhttps://docs.cloud.google.com/support/bulletins/index#gcp-2026-048