Researcher Earns $148,337 for Google Cloud Production RCE Vulnerability
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A researcher has earned a total of 148,337 USD from Google for uncovering a set of flaws in Google Cloud\u2019s Application Integration service that escalated into remote code execution (RCE) in Google Cloud<\/a> production.<\/p>\n The core bug is now tracked as CVE\u20112026\u20112031. The researcher Arvin Shivram has publicly documented the issue under the title \u201cStubZero: $148,337 RCE in Google Cloud Production\u201d on BruteCat\u2019s blog.<\/p>\n CVE-2026-2031 as a critical access control flaw in Google Cloud Application Integration that can enable remote code execution, carrying a CVSS score of 10.0.<\/p>\n Google has addressed the issue by restricting internal endpoint access, fixing IDOR weaknesses<\/a>, and strengthening RPC security controls.<\/p>\n According to Arvin Shivram\u2019s own write\u2011up on BruteCat.com, the chain began when an automated fuzzing tool flagged the internal API cloudcrmipfrontend-pa.googleapis.com for returning HTTP 200 responses on suspicious debugging endpoints.<\/p>\n Further probing revealed an endpoint, v1\/integrationPlatform\/getProtoDefinition, that would return protobuf descriptors for arbitrary internal messages and services, including YouTube and Google\u2019s internal CRM stack.<\/p>\n Because Google\u2019s internal services are heavily protobuf\u2011driven, this \u201creq2proto as a service\u201d style leak gave the attacker a near\u2011complete view of internal API schemas, making black\u2011box research<\/a> far easier.<\/p>\n The same API surface also exposed a listQuotaQueue endpoint, which, when queried with the right parameters and X-Goog-Encode-Response-If-Executable: base64, leaked an internal workflow execution queue along with a crucial clientId value (default).<\/p>\n Armed with the leaked client ID, the researcher could create draft workflows via createDraftWorkflow in the internal Application Integration backend and began exploring tasks visible in the discovery document.<\/p>\n The turning point came with an internal task type called GenericStubbyTypedTaskV2, which the BruteCat article identifies as a generic wrapper around Google\u2019s Stubby RPC framework inside Application Integration workflows.<\/p>\nGoogle Cloud Production RCE Vulnerability<\/strong><\/h2>\n