Live › vulnerability › CVE-2026-93327
The SubWorkflow task in Google Cloud Application Integration deserializes untrusted data without checking it, so a crafted serialized object can run code. An attacker needs an authenticated account to send it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Anyone using Google Cloud Application Integration with the SubWorkflow task before 2026-09-11. An attacker needed an authenticated account that could submit a crafted serialized object. Google fixed it on its side, so customers can skip any update; an optional review of who could edit integrations is reasonable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Application Integration | vendor | < 2026-09-11 | 2026-09-11 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.
This vulnerability was patched on 11 September 2026, and no customer action is needed.
This page as .md · .json · in your agent: get_signal("CVE-2026-93327")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.