GoogleAnalysisGoogle Cloud patches Compute Engine authorization flaw in snapshot APIs
What happened.Google Cloud published security bulletin GCP-2026-072 disclosing an authorization bypass vulnerability within Google Compute Engine disk snapshot management interfaces.
Why it matters.Cloud multi-tenancy and project isolation depend upon immutable authorization checks at the storage volume API layer. When snapshot operations evaluate permissions inconsistently, cross-project data boundaries break down. Enterprise cloud security teams should review audit logs for anomalous snapshot API calls across historical access periods. Infrastructure architects should enforce service control policies to prevent unexpected data replication between cloud projects.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-85299 with an 8.2 CVSS rating, missing authorization checks in disks.createSnapshot and regionDisks.createSnapshot APIs allowed improper privilege evaluation.
- Exploitation path: Authenticated users possessing restricted roles could invoke snapshot creation across projects, enabling unauthorized access to underlying persistent disk contents.
- Remediation releases: Google deployed managed backend updates across all Compute Engine control planes globally, eliminating the authorization defect with zero customer downtime and no manual action required.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: