CVE-2026-12717
Description
A flaw was found in BigQuery Data Transfer Service. An authenticated attacker can achieve arbitrary code execution within the connector container by supplying crafted Java Database Connectivity (JDBC) connection string parameters. Successful exploitation can further allow the attacker to escalate privileges within the tenant project.
Statement
A CRITICAL vulnerability in Google Cloud's BigQuery Data Transfer Service allows an authenticated attacker to achieve arbitrary code execution within the connector container by supplying crafted Java Database Connectivity (JDBC) connection string parameters to the service's CData JDBC driver integration. Successful exploitation can further allow the attacker to escalate privileges within the affected tenant project on Google Cloud Platform. Google remediated the vulnerability in the managed service and indicated that no customer action is needed on the service side.
Within the Red Hat portfolio, this flaw is tracked for the Fedora community package golang-google-api, which ships the google.golang.org/api BigQuery Data Transfer Service client library. This affect is delegated, and a fix is being pursued through the community update process for Fedora.
Red Hat rates this flaw as CRITICAL with a CVSS 3.1 score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which is broadly consistent with the upstream CVEORG CVSS 4.0 score of 9.4; the difference reflects the different CVSS versions used rather than a materially different view of severity.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
