Missing authorization in QueryEngineTask (CVE-2026-12710)

A Confused Deputy vulnerability was discovered in the Email Task component in Application Integration versions prior to June 30, 2026.

For more information, see the GCP-2026-066 security bulletin.

A Deserialization of Untrusted Data vulnerability was discovered in the JavaScript Task in Application Integration versions prior to June 28, 2026.

For more information, see the GCP-2026-065 security bulletin.

An Incorrect Authorization vulnerability was discovered in the task configuration in Application Integration versions prior to June 17, 2026.

For more information, see the GCP-2026-064 security bulletin.

Upcoming authorization changes for integration runs

Application Integration is updating how identities are handled for integration runs. Every run will act as either the person who triggered it or a run-as service account that you configure, and running an integration will require permission to act as that service account.