Why does GCP-2026-069 have no CVE ID yet?

Google Cloud Security Bulletins published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

GCP-2026-069Disclosed before NVD

GCP-2026-069 — Published: 2026-10-19Description Description Severity Notes Security vulnerabilities were discovered in Istio and Envoy Proxy…

Vendor

Google Cloud Security Bulletins

Published

October 19, 2026

Last Modified

October 19, 2026

📋 Description

Published: 2026-10-19Description Description Severity Notes Security vulnerabilities were discovered in Istio and Envoy Proxy (ISTIO-SECURITY-2026-007). For instructions and more details, see the Cloud Service Mesh security bulletin. Moderate to High GHSA-w44g-8m76-8gc5 GHSA-7p2q-4xvg-vxc6 GHSA-8vc2-jrm4-835w GHSA-47vj-9r25-wv5j

🔗 References (1)

advisoryhttps://docs.cloud.google.com/support/bulletins/index#gcp-2026-069