CVE-2026-2264: Google Cloud Apigee-X SSRF and Token Exposure via SetIntegrationRequest Policy
CVE-2026-2264 affects the SetIntegrationRequest policy in Google Cloud Apigee-X and allows Server-Side Request Forgery (SSRF) and exfiltration of service account access tokens. The record rates it critical with CVSS 4.0 base score 9.2 and states that exploitation requires an administrator to first create an insecure API proxy configuration. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.
Overview
The record describes CVE-2026-2264, a flaw in the SetIntegrationRequest policy of Google Cloud Apigee-X that enables Server-Side Request Forgery (SSRF) and the exfiltration of service account access tokens. The CNA is Google Cloud and the weakness is classified as CWE-918. According to the record, exploitation requires that an administrator first establish an insecure configuration of the API proxy.
Impact
The record rates the issue as critical, with a CVSS 4.0 base score of 9.2 and a vector indicating high impact on confidentiality, integrity and availability. Because the flaw can expose service account access tokens, a successful attack could allow an attacker to act with the privileges of the affected service account. This consequence is an inference from the description and is not detailed in the sources.
Affected products and versions
The record lists Google Cloud Apigee-X as affected in versions below 1.14.4, below 1.15.2 and below 1.16.1. The record contains no separate list of fixed versions. Organizations should confirm their exact release against the vendor bulletin GCP-2026-034.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog, and the SSVC exploitation value is none. No confirmed exploitation in the wild appears in the sources consulted. The record also gives an EPSS probability of 0.0036 (percentile 0.27903), which indicates a low modeled likelihood of exploitation activity.
Remediation and mitigation
- Review the vendor security bulletin and apply the Apigee-X update that corresponds to your release line.
- Audit API proxies that use the SetIntegrationRequest policy and remove insecure configurations.
- Restrict which administrators can create or modify proxy configurations, and apply least privilege to service accounts.
- Rotate service account credentials if there is any indication that tokens may have been exposed.
Detection guidance
- Review changes to API proxy configurations and route use of the SetIntegrationRequest policy to security review.
- Monitor outbound requests from Apigee runtime components to internal or metadata endpoints and investigate unexpected destinations.
- Check audit logs for unusual use of service account credentials.
Limitations of the available information
The record does not describe which exact configuration becomes insecure, the technical conditions for exploitation, or the attack path. It does not state a fixed version explicitly, and its fixes list is empty. The EPSS date in the record (2026-10-13) is later than the publication date (2026-05-26) and should be verified. The linked vendor bulletin was not reviewed in full for this analysis.
Frequently asked questions
Which Apigee-X versions does the record list as affected?
The record lists Google Cloud Apigee-X versions below 1.14.4, below 1.15.2 and below 1.16.1. Check the vendor bulletin GCP-2026-034 to confirm your exact release.
Is this vulnerability being actively exploited?
The record does not list this CVE in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.
What should administrators do first?
Apply the Apigee-X update for your release line, audit proxies that use the SetIntegrationRequest policy, and rotate service account credentials if exposure is suspected.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.