CVE-2026-11841: Critical severity Google App Engine Fileaccess vulnerability
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InspectorP61x / InspectorP62xto a version that resolves this vulnerability.Fixed in 5.4.0 - Compensating control
Mitigate AppEngine Fileaccess over HTTP exposure by ensuring the HTTP-based file access feature is not reachable without authentication (apply proper access restrictions so unauthenticated read/write to sensitive filesystem areas is blocked).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11841?
CVE-2026-11841 has a severity rating of 9.4, indicating it is critical.
How does CVE-2026-11841 affect Google App Engine Fileaccess?
CVE-2026-11841 allows attackers to perform unauthenticated read and write operations on sensitive filesystem areas due to improper access restrictions.
What are the potential risks associated with CVE-2026-11841?
The risk associated with CVE-2026-11841 includes unauthorized access to sensitive data and potential data modification.
Who is affected by CVE-2026-11841?
Any user of Google App Engine Fileaccess may be affected by CVE-2026-11841.
What should organizations do to mitigate CVE-2026-11841?
Organizations should immediately apply any available security patches and review their access controls to mitigate CVE-2026-11841.