Starting October 15, 2026, Application Integration enforces security fixes for IAM, run-as service accounts, and iam.serviceAccounts.actAs checks, requiring…

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Application Integration versions prior to August 27,…

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Application Integration versions prior to August 27, 2026. For more information, see the GCP-2026-068 security bulletin.

A Confused Deputy vulnerability was discovered in the Email Task component in Application Integration versions prior to June 30, 2026.

For more information, see the GCP-2026-066 security bulletin.

A Deserialization of Untrusted Data vulnerability was discovered in the JavaScript Task in Application Integration versions prior to June 28, 2026.

For more information, see the GCP-2026-065 security bulletin.

An Incorrect Authorization vulnerability was discovered in the task configuration in Application Integration versions prior to June 17, 2026.

For more information, see the GCP-2026-064 security bulletin.

Upcoming authorization changes for integration runs

Application Integration is updating how identities are handled for integration runs. Every run will act as either the person who triggered it or a run-as service account that you configure, and running an integration will require permission to act as that service account.