Vulnerabilities · 15h ago

Google patched Application Integration service-account impersonation flaw

Google’s October 19, 2026 security bulletin disclosed an authorization flaw in Application Integration that let authenticated users impersonate a service account. Google says it patched the flaw on August 27, before publishing the bulletin.

The issue affected AuthConfig validation and the integration execution runtime. An authenticated user could escalate privileges and act as a service account in the Google Cloud project, potentially gaining that identity’s project permissions.

For customers using Application Integration, this is a provider-side fix rather than a tenant patch: Google says no customer action is required. The bulletin does not indicate that customer environments remain exposed.

CVEs in this update

379 CVEs

Across react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel, and related packages.

20 critical · 183 high · 118 medium · 9 low

24 in CISA KEV · 129 with EPSS above 1%

25 with functional or packaged public exploit code

Highest severity: CVE-2025-55182 · 10.0 CRITICAL

Highest EPSS: CVE-2021-22005 · 100%

Showing the top 10 by KEV, EPSS, and severity.

Timeline

Sources

1 source covering this story

Entities

Part of the PlainSec briefing for 2026-10-24

Editions

Related stories