External risk intelligence

Google Cloud BigQuery Data Transfer Service CData JDBC Remote Code Execution and Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-12717

This vulnerability resides within a JDBC driver integration used by a cloud data transfer service. Such components typically operate as backend infrastructure or internal service-to-service connectors rather than public-facing internet services. While network-accessible in specific cloud service configurations, it is not a standard internet-facing attack surface.

Remote Code Execution

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an Improper Input Validation vulnerability within the CData JDBC driver integration in Google Cloud's BigQuery Data Transfer Service. The issue could allow an authenticated attacker to execute remote code and escalate privileges within a tenant project by using specially crafted connection string parameters. The vulnerability has been patched.

Input validation flaw in cloud data transfer.
Matters for understanding potential internal security risks.
Confirm relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

An authenticated attacker with network access could leverage an Improper Input Validation vulnerability within the CData JDBC driver integration. By providing a specially crafted JDBC connection string, the attacker could execute arbitrary code within the connector's environment, potentially leading to elevated privileges within the affected tenant project.

Attacker needs prior authentication.
Triggered by a malicious JDBC connection string.
Risk of remote code execution and privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could execute arbitrary code within the connector container and potentially escalate privileges in the tenant project by manipulating JDBC connection string parameters, when supported by the advisory's described conditions.

Connector container code execution.
Crafted JDBC connection string parameters.
Tenant project privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Google Cloud BigQuery Data Transfer Service integration with the CData JDBC driver is affected by this vulnerability. Since the issue was patched on May 1, 2026, and no customer action is needed, the primary responsibility lies with Google Cloud to ensure the update is deployed.

Ownership: Google Cloud Platform
Verify first: Confirm patch deployment date.
Action: None required by customers.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Google Cloud BigQuery Data Transfer Service?

It is a fully managed service that automates data movement from SaaS applications and cloud storage into BigQuery. It uses specialized connectors, such as the CData JDBC driver, to interface with various data sources. These drivers act as translators that allow the transfer service to pull data from external systems into a format compatible with Google's analytics data warehouse.

What does the Improper Input Validation weakness mean in CVE-2026-12717?

This weakness, categorized as CWE-74, occurs when software processes user-supplied input without sufficiently verifying its structure or intent. In this instance, the CData JDBC driver integration fails to properly sanitize specific connection string parameters. Because these strings are treated as executable instructions, an attacker can supply malicious input that the system interprets as commands, leading to unauthorized code execution.

How is this vulnerability triggered by an attacker?

The vulnerability is triggered when an authenticated user provides a specially crafted JDBC connection string to the service. It is important to note that this flaw is not triggered by standard, legitimate database connection requests. The attack requires an adversary to intentionally manipulate the parameter fields to inject malicious logic that the driver then processes.

Is CVE-2026-12717 considered an internet-facing risk?

According to Halo Surface Signal, this vulnerability is unlikely to be internet-facing. Because it resides within a backend JDBC driver integration, it typically operates as part of internal service-to-service communication. While it remains a critical concern for privilege escalation, it does not represent a standard service accessible directly from the open internet.

What steps should I take to address CVE-2026-12717?

No action is required on your part. This vulnerability was managed and patched by Google Cloud on May 1, 2026. Because the affected software components are part of a managed cloud service, the provider handles all necessary security updates and deployments behind the scenes. You can simply confirm that your tenant environment is operating normally.

References

docs.cloud.google.com/support/bulletins

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.