CVE-2026-107365: Unintended API access through the Google Cloud Monitoring data source resource proxy
A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Cloud Monitoring pluginto a version that resolves this vulnerability.Fixed in 12.6.7
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who has query access to a Google Cloud Monitoring data source can exploit the resource proxy to send requests to other Cloud Monitoring API paths using the data source's credentials.
What data could be exposed?
The user may be able to read data from any Google Cloud project that the credentials used by the data source can access. If the data source forwards the user's OAuth identity or uses Workload Identity Federation, exposure is limited by that credential's permissions.
What version fixes the issue?
The issue is fixed in Google Cloud Monitoring plugin version 12.6.7.