VULNERABILITY INTELLIGENCE

CVE-2026-84962

CVSS score5.7 MEDIUM
EPSS probability0.18%
CISA KEVNot currently listed
Published2026-09-03
Last modified2026-09-17
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Description

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

Weakness classification

  • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

Primary references