CVE-2026-11841: Critical severity Google App Engine Fileaccess vulnerability
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ICR890-4to a version that resolves this vulnerability.Fixed in 2.15.0 - Upgrade
Upgrade
InspectorP61x and InspectorP62xto a version that resolves this vulnerability.Fixed in 5.4.0 - Compensating control
Restrict HTTP-based AppEngine Fileaccess so that the filesystem directory exposure (unauthenticated access to sensitive filesystem areas via AppEngine Fileaccess over HTTP) is prevented without authentication.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11841?
CVE-2026-11841 has a severity rating of 9.4, indicating it is critical.
How does CVE-2026-11841 affect Google App Engine Fileaccess?
CVE-2026-11841 allows attackers to perform unauthenticated read and write operations on sensitive filesystem areas due to improper access restrictions.
What are the potential risks associated with CVE-2026-11841?
The risk associated with CVE-2026-11841 includes unauthorized access to sensitive data and potential data modification.
Who is affected by CVE-2026-11841?
Any user of Google App Engine Fileaccess may be affected by CVE-2026-11841.
What should organizations do to mitigate CVE-2026-11841?
Organizations should immediately apply any available security patches and review their access controls to mitigate CVE-2026-11841.