CyberSecBulletin
CVE-2026-85267NVD status: Awaiting Analysis

Cloud Shell: Missing Origin Validation in WebSockets

Published Updated By the CyberSecBulletin desk

CVE-2026-85267 is a high-severity missing origin validation in websockets vulnerability in Cloud Shell from Google Cloud, with a CVSS 4.0 base score of 8.7 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists version 2026-07-22 as the first without the flaw, so updating Cloud Shell to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.21% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Cloud Shell to 2026-07-22 or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
  3. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

VendorProductAffected versionsFixed in
Google CloudCloud Shellbefore 2026-07-222026-07-22

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Attack requirements
NoneThe attack does not depend on a particular deployment or configuration.
Privileges required
NoneNo account or login is needed.
User interaction
PassiveA user only needs to do something routine, such as viewing a page.
Confidentiality (vulnerable system)
HighSerious loss of confidentiality on the vulnerable system.
Integrity (vulnerable system)
HighSerious loss of integrity on the vulnerable system.
Availability (vulnerable system)
HighSerious loss of availability on the vulnerable system.
Confidentiality (other systems)
LowLimited loss of confidentiality on systems beyond the vulnerable one.
Integrity (other systems)
LowLimited loss of integrity on systems beyond the vulnerable one.
Availability (other systems)
LowLimited loss of availability on systems beyond the vulnerable one.

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear. Scored by CNA.

Official description

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched on 22 July 2026, and no customer action is needed.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Missing Origin Validation in WebSockets

The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

How developers prevent this class of flaw

  • Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.
  • Use a randomized CSRF token to verify requests.
  • Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.

More Missing Origin Validation in WebSockets vulnerabilities (CWE-1385)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).

References

Recent Missing Origin Validation in WebSockets vulnerabilities

Spotted an error? Tell us.