CVE-2026-12710: Missing Authorization in Application Integration QueryEngineTask
A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an external attacker to access sensitive internal data.
The issue was patched on April 4, 2026; no customer action is required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026-04-04 - Remove
Remove
Google Cloud Application Integration QueryEngineTask (ASIS_TEMPLATE)from your environment.Remove or replace any QueryEngineTask (ASIS_TEMPLATE) tasks in Google Cloud Application Integration workflows, as recommended.
- Compensating control
Restrict external traffic that uses Application Integration QueryEngineTask so integrations return PERMISSION_DENIED for external requests (QueryEngineTask in external traffic should be blocked until patched).
Event History
Frequently Asked Questions
Which deployments were affected?
Google Cloud Application Integration QueryEngineTask versions from 2025-04-28 through 2026-04-04 were affected.
What access could an attacker obtain?
An external attacker could access sensitive internal data through the missing authorization issue in QueryEngineTask.
Is customer remediation required?
No customer action is required. The issue was patched on April 4, 2026.