CVE-2026-12717 CRITICAL

CVE-2026-12717: Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection

Vendor Google Cloud
Product BigQuery Data Transfer Service
Weakness CWE-74
Published August 26, 2026
Last update August 26, 2026
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear

What the vulnerability does

01Description

An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in the tenant project using crafted JDBC connection string parameters. This vulnerability was patched on 1 May 2026, and no customer action is needed.

Key dates

02Disclosure timeline

August 26, 2026 CVE published
August 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-16759 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters CVE-2024-1128 Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A CVE-2024-35777 WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability CVE-2019-25150 Email Templates <= 1.3 - HTML Injection CVE-2024-38700 WordPress WPCS – WordPress Currency Switcher Professional plugin <= 1.2.0.3 - Arbitrary Shortcode Execution vulnerability