CVE-2026-84962: Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
Published Sep 3, 2026
·Updated
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
Affected Software
1 affected component
Google Google Cloud KMS
Event History
Sep 3, 2026
CVE Published
via MITRE·03:03 PM
Data Sourced
via MITRE·03:03 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Dec 19, 58643
Event
via NVD·05:22 AM
Frequently Asked Questions
1
Does exploitation require user interaction?
Yes. The vulnerability is rated UI:R, meaning exploitation requires user interaction; the specific interaction is not provided.
2
How difficult is exploitation once the required access is available?
The attack complexity is rated high (AC:H), indicating additional conditions or careful exploitation are required beyond network reachability and privileges.