Threat reportVulnerabilityTL-2026-0915
CVE-2026-2031 "StubZero": Remote Code Execution in Google Cloud Application Integration via Exposed Proto Descriptors, GenericStubbyTypedTaskV2 and ACL Bypass
CVE-2026-2031 "StubZero" (TL-2026-0915), also tracked as StubZero, is a critical-severity software vulnerability scored CVSS 10, first published 2026-06-23. It has no confirmed attribution, affects Google Google Cloud Application Integration, references 1 CVE (CVE-2026-2031), maps to 14 MITRE ATT&CK techniques (T1059, T1078, T1098), and is covered by 9 detection rules and 20 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-0915
- Threat ID
- TL-2026-0915
- Also known as
- StubZero
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud-service-providers, saas
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
How CVE-2026-2031 "StubZero" works
StubZero (CVE-2026-2031) is a critical access-control flaw chain in Google Cloud Application Integration that allowed a researcher to achieve remote code execution inside Google's production environment as a privileged service identity. Exposed internal debugging endpoints leaked arbitrary google3 protobuf descriptors and a 'default' clientId, the GenericStubbyTypedTaskV2 task type enabled arbitrary internal Stubby RPC calls, and an ACL endpoint bypassed the two-person workflow-publishing approval. Google has patched the issue; a detailed proof-of-concept was published by BruteCat.
StubZero is a multi-stage access-control and remote-code-execution chain in Google Cloud Application Integration disclosed by security researcher Arvin Shivram (BruteCat) and tracked as CVE-2026-2031 (CVSS 10.0). The bug bounty payouts totalled $148,337 across two related chains. Google has fully remediated the issues; this record documents the disclosed mechanics for defensive and detection-engineering purposes.
First chain (production RCE). Automated fuzzing surfaced the internal-facing host cloudcrmipfrontend-pa.googleapis.com responding HTTP 200 to debugging endpoints. The endpoint /v1/integrationPlatform:getProtoDefinition behaved as 'req2proto as a Service' — returning the protobuf definition of any message or service in google3 (Google's internal monorepo), including unrelated stacks such as YouTube InnerTube and Google's internal CRM. Requests were authenticated with Google first-party SAPISID cookies plus a calculated Authorization: SAPISIDHASH header, scoped to origin https://console.cloud.google.com. A second endpoint, /v1/integrationPlatform:listQuotaQueue, queried with a filter such as client_id>"123", ?alt=proto and the header X-Goog-Encode-Response-If-Executable: base64, leaked an internal workflow execution queue (Spanner-to-Salesforce sync data, account IDs, due-diligence status) and crucially revealed client_id 'default'. Using that clientId, /v1/integrationPlatform:createDraftWorkflow created a draft workflow, and the discovery document exposed GenericStubbyTypedTaskV2 — a generic wrapper around Google's internal Stubby RPC framework (referenced in Application Integration JavaScript on gstatic.com with the stubby_48px_blue.svg icon). The task accepts serverSpec, serviceName and serviceMethod parameters, enabling arbitrary Stubby RPC calls from the production environment using the integration platform's privileged service identity. To publish, the two-person approval / single-publisher restriction was bypassed via /v1/integrationPlatform/auth:setAcl, adding attacker-controlled obfuscated Gaia IDs with role 105, followed by toggleRequestToPublishWorkflow and publishWorkflow. A demonstration RPC to serverSpec gslb:alkali-base, serviceName ServerStatus, serviceMethod GetServices returned an rpc.ServiceList exposing internal services such as AlkaliBaseAccountService. The createDraftWorkflow fix propagated across load-balanced backends roughly one hour after the PoC completed, and collaborator 'shrugged' found Google's initial mitigation was only partially deployed, allowing repeated requests to hit still-vulnerable backends during the race window.
Second chain (cross-tenant IDOR, ~3 months later). The public Application Integration API exposed an IDOR: requesting GET /v1/projects/<your-project>/locations/us-central1/integrations/x/versions/<victim-uuid> returned victim resources because authorization only validated the caller's project ID, not ownership of the target UUID. Because UUIDs span ~10^36, direct brute force was infeasible. The TestCases service was abused instead: POST /$rpc/google.cloud.integrations.v1alpha.TestCases/ListTestCases with the workflow_id filter (proto field 2) omitted returned test cases across every GCP project, exposing creator emails (many @google.com). Using filter operators (>, <=) on the workflow_id field, a binary search (~128 requests) reconstructed full victim integration UUIDs, enabling theft of complete victim integration definitions (triggers, GenericRestV2Task configs, parameter bindings, lastModifierEmail). Creating integrations with internal tasks such as PythonTask succeeded, and test-case execution stack traces revealed the backend ExecuteStubbyCallRequest code path consuming serverSpec, serviceName and serviceMethod directly — confirming the same Stubby execution surface.
Impact context: in Google's Borg/production model, Stubby RPC is governed by per-method allowlists in RpcSecurityPolicy, with frontends calling downstream services under their own production service identity while carrying end-user context via security tickets. Compromising the integration frontend's Stubby access therefore dramatically expanded reachable internal attack surface — RCE here means arbitrary internal RPC calls as a production identity rather than a traditional OS shell.
MITRE ATT&CK techniques used in TL-2026-0915
Execution
T1059 Command and Scripting Interpreter
Defense Evasion
Persistence
Collection
T1119 Automated Collection; T1530 Data from Cloud Storage
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
collection
T1213 Data from Information Repositories
Discovery
T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Credential Access
Reconnaissance
T1590 Gather Victim Network Information; T1595 Active Scanning
Affected products and versions in CVE-2026-2031 "StubZero"
- Google — Google Cloud Application Integration
Vulnerable versions: Production service (pre-2026 remediation)
Fixed in: Server-side remediation deployed by Google (2026) - Google — cloudcrmipfrontend-pa internal CRM integration frontend
Vulnerable versions: Production service (pre-fix)
Fixed in: Internal/debugging endpoint access restricted (2026)
Remediation for CVE-2026-2031 "StubZero"
Patches
- Google internal: createDraftWorkflow / internal endpoint access restricted, IDOR fixed, Stubby RPC controls strengthened (no public KB; remediated in Google production).
Immediate actions
- Apply Google's server-side fixes (no customer action required; the vulnerable internal endpoints and IDOR are patched by Google).
- Restrict access to internal/debugging RPC endpoints (e.g. getProtoDefinition, listQuotaQueue) so protobuf descriptors and internal queues are never exposed to first-party console origins.
- Enforce ownership/object-level authorization on resource-by-UUID lookups so project-scoped auth cannot read cross-tenant integration versions.
Workarounds
- None required for customers — the vulnerability resided in Google-operated production services, not in deployable customer software.
Longer-term hardening
- Validate that separation-of-duties / two-person publishing approvals cannot be circumvented by directly mutating ACLs (setAcl) outside the approval flow.
- Remove or strongly gate generic RPC-wrapper task types (GenericStubbyTypedTaskV2) so workflow tasks cannot invoke arbitrary internal services as the platform's service identity.
- Ensure security mitigations propagate atomically across all load-balanced backends to eliminate partial-patch race windows.
- Audit list/test endpoints (ListTestCases) to require mandatory tenant-scoping filters and reject requests that omit the workflow/project filter field.
CVEs associated with CVE-2026-2031 "StubZero"
Weaknesses (CWE) in CVE-2026-2031 "StubZero"
Timeline of CVE-2026-2031 "StubZero"
- Automated fuzzing detects cloudcrmipfrontend-pa.googleapis.com responding HTTP 200 to internal debugging endpoints; getProtoDefinition proto-descriptor leak identified.
- Google VRP panel awards $60,000 for compromise of the Google Cloud production environment (first RCE chain via GenericStubbyTypedTaskV2 / Stubby RPC).
- Fuzzer surfaces IDORs in the public Application Integration API; initial cross-tenant IDOR report filed.
- Report upgraded to P0/S0 after RCE escalation (TestCases binary-search UUID reconstruction + internal task execution) is explained.
- Google VRP panel awards $75,000 for the second production-compromise chain.
- Additional single-service privilege-escalation vulnerability identified.
- Supplemental $13,337 award granted; chain bounty total reaches $148,337.
- BruteCat publishes the 'StubZero: $148,337 RCE in Google Cloud Production' writeup; covered by Cyber Security News as CVE-2026-2031 (Google has patched).
Sources cited for CVE-2026-2031 "StubZero"
- StubZero: $148,337 RCE in Google Cloud Production
- Google Cloud Production RCE Vulnerability (CVE-2026-2031)
- Episode 177: 2x Google RCE with VRP Legend Brutecat
- HackerNotes Ep. 177 — Double Google RCE with VRP Legend Brutecat
- Seclog #179 — Google Cloud RCE Earns Big Bounty
- Intigriti Bug Bytes #236 (May 2026)
- Brutecat Security (research index)
Detection coverage for TL-2026-0915
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0915 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.