A Deserialization of Untrusted Data vulnerability was discovered in the JavaScript Task in Application Integration versions prior to June 28, 2026.

A Confused Deputy vulnerability was discovered in the Email Task component in Application Integration versions prior to June 30, 2026.

For more information, see the GCP-2026-066 security bulletin.

An Incorrect Authorization vulnerability was discovered in the task configuration in Application Integration versions prior to June 17, 2026.

For more information, see the GCP-2026-064 security bulletin.

Upcoming authorization changes for integration runs

Application Integration is updating how identities are handled for integration runs. Every run will act as either the person who triggered it or a run-as service account that you configure, and running an integration will require permission to act as that service account.

Missing authorization in QueryEngineTask (CVE-2026-12710)

A missing authorization vulnerability ( CVE-2026-12710 ) in QueryEngineTask in Application Integration was patched on April 4, 2026, and no customer action is needed.