Threat Intelligence / CVE / CVE-2026-2031

CVE-2026-2031

CVSS 10 · EPSS 0.5% · Priority 6.6/10 · Published 2026-05-15

As of 2026-05-15, CVE-2026-2031 is a CVSS 10 vulnerability. EPSS exploitation probability 0.5%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2026-05-15

An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker to disclose sensitive internal information and execute arbitrary code using specially crafted HTTP requests to inadvertently exposed internal API endpoints.

Weaknesses (CWE)

CWE-862

Threats tracking this CVE

CVE-2026-2031 "StubZero": Remote Code Execution in Google Cloud Application Integration via Exposed Proto Descriptors, GenericStubbyTypedTaskV2 and ACL Bypass — CRITICAL

References

https://docs.cloud.google.com/gemini/enterprise/docs/release-notes#May_07_2026

Full detection coverage & IOCs for threats exploiting CVE-2026-2031 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.