GCP-2026-068 — Published: 2026-10-14Updated: 2026-10-24Description Description Severity Notes An Incorrect Authorization vulnerability in the…

Published: 2026-10-14Updated: 2026-10-24Description Description Severity Notes An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Application Integration versions prior to August 27, 2026. What should I do? No customer action to resolve this vulnerability is required. This vulnerability was patched on August 27, 2026. To improve security against authorization vulnerabilities, starting October 15, 2026, Application Integration requires the iam.serviceAccounts.actAs permission on the run-as service account for any new integrations. Existing integrations and their new versions are unaffected.For more information, see Prepare for upcoming authorization changes. What vulnerabilities are being addressed? An authenticated user could escalate privileges and impersonate a service account in the Google Cloud project. High CVE-2026-85298