Root cause
Resource-ownership checks and task-authority checks were inconsistent. The researcher compared customer-project permissions with the authority of backend integration services, identifying gaps between authorized customer activity and privileged service operations.
Demonstrated impact
The authenticated-user research reports cross-project access and test execution. Production compromise potential was reportedly confirmed by Google, which stopped further testing; completed code execution in production was not demonstrated. Wider impact remains unverified.
Lessons for review
- Editorial lesson: authorize the actual resource owner at every service boundary rather than relying on an enclosing project context.
- Editorial lesson: independently constrain service-task authority even when the initiating user may legitimately configure an integration.
- Editorial lesson: use cross-tenant negative tests and track observed effects separately from vendor-assessed potential.
Award and evidence
Only the second report’s base award; excludes the later $13,337 and first report. USD remains contextual: Google’s July 2024 USD-denominated VRP announcement and October 2024 Cloud-program continuity statement, not settlement evidence.
Read primary article text, including the dated byline, and official Google sources. The July 2024 USD announcement was read in rendered browser text. No target testing.
- Award and vendor impact assessment are researcher-published claims, not independently reviewed vendor correspondence.
- The article-level CVE is not assigned here because its scope across the separate reports is ambiguous.
- No precise fix date, payment occurrence or settlement date is established.
- Currency inference uses 2024 program context, about two years before the award. The current Cloud policy uses a dollar symbol without an explicit USD statement; no independent settlement evidence is claimed.
Recorded timeline
- Published
- 2026-05-22explicit · Visible article header supplies May 22, 2026 and author Arvin Shivram.
- Reported
- 2026-03-21explicit
- Awarded
- 2026-04-28explicit
Sources and provenance
- StubZero: $148,337 RCE in Google Cloud Production Arvin Shivram (Brutecat) · reviewed 2026-10-03
- Increasing Google & Alphabet VRP rewards up to $151,515 Sam Erb and Krzysztof Kotowicz / Google · reviewed 2026-10-03
- Introducing Google Cloud’s new Vulnerability Reward Program Michael Cote and Sri Tulasiram / Google Cloud · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot d5550c789111. Open the complete JSON contract.