# CVE-2026-14934: Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise

> CVE-2026-14934: Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise. CVSS 9.4 (CVSS 4.0).

Canonical: https://rewindex.com/cve/CVE-2026-14934
Last updated: 2026-07-13T19:49:49Z

- Published: 2026-07-13 10:20 UTC · Updated: 2026-07-13 19:49 UTC · Assigner: GoogleCloud
- CVSS: 9.4 (CVSS 4.0) · Severity: Critical
- EPSS: 0.35%, 28th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-862

## Description

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. This vulnerability was patched on 10 May 2026, and no customer action is needed.

## Affected vendors and products

- Google Cloud: BigQuery
- Google Cloud: Colab Enterprise
- Google Cloud: Dataform

## Tracked companies

- [Google Cloud](https://rewindex.com/company/google-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-14934)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-14934)
- [https://docs.cloud.google.com/support/bulletins\#gcp-2026-047](https://docs.cloud.google.com/support/bulletins#gcp-2026-047)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-14934 · Markdown: https://rewindex.com/cve/CVE-2026-14934.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-14934 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:50:15.191Z