CVE-2026-85299: Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
Published Oct 27, 2026
·Updated
A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data.
This vulnerability was patched on 31 August 2026, and no customer action is needed.
Affected Software
1 affected component
Google Compute Engine<2026-08-31
Event History
Oct 27, 2026
CVE Published
via MITRE·09:02 AM
Data Sourced
via MITRE·09:02 AM
DescriptionWeakness
Frequently Asked Questions
1
Who could exploit this issue?
An attacker needed to be authenticated to Google Cloud Platform. The issue affected the Compute Engine disks.createSnapshot and regionDisks.createSnapshot APIs before the service-side patch on 31 August 2026.
2
Is customer remediation or configuration change required?
No. The issue was patched by Google on 31 August 2026, and the provided advisory states that no customer action is needed.