External risk intelligence

Google Cloud Apigee SSRF via Insecure Request Policy

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-2264

The vulnerability affects Apigee, an API management platform typically deployed as an internet-facing gateway or edge service to handle public-facing API traffic. While successful exploitation requires a specific configuration, the product's primary role is to act as a public-facing entry point for services.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recent vulnerability has been identified in the Google Cloud Apigee SetIntegrationRequest policy, enabling remote attackers to conduct Server-Side Request Forgery and exfiltrate sensitive access tokens. This issue can occur if an API proxy is configured insecurely, potentially exposing service account credentials.

Attackers can steal access tokens with insecure configurations.
This vulnerability affects a critical API management platform.
Confirm relevance and exposure for this specific product.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to an API proxy configured with the `SetIntegrationRequest` policy. If an administrator has previously set up an insecure configuration for the API proxy, the attacker can leverage this flaw to make the server perform unintended requests to arbitrary locations, potentially exfiltrating sensitive service account tokens.

Requires an insecure API proxy configuration.
Triggered by a crafted request to a policy.
Risk of unauthorized token exfiltration.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to exfiltrate service account access tokens when an API proxy is configured insecurely.

Service account access tokens at risk.
Insecure API proxy configuration enables access.
Unauthorized access to cloud resources may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Google Cloud Apigee platform is likely managed by platform or application teams, with oversight from network and security teams. Initial efforts should focus on identifying all instances of the affected Apigee configuration, assessing their reachability and business criticality, and then engaging the accountable owners to plan remediation based on the identified risk.

Platform and application teams own resolution.
Verify Apigee configurations and exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Cloud Apigee and what is it used for?

Apigee is a Google Cloud platform designed for developing, managing, and securing APIs. It acts as an intermediary layer, or API gateway, between backend services and the applications or users that access them. Organizations use it to control traffic, enforce security policies, and monitor API performance for their digital services.

How does CVE-2026-2264 enable Server-Side Request Forgery?

This vulnerability involves CWE-918, a weakness known as Server-Side Request Forgery (SSRF). In the context of the SetIntegrationRequest policy, this flaw allows an attacker to manipulate the service into making unauthorized network requests to arbitrary destinations. By forcing the server to send these requests, an attacker can trick the system into revealing sensitive data, such as service account access tokens, which are used to authenticate with other cloud resources.

What triggers this vulnerability in an Apigee API proxy?

Exploitation requires two specific conditions. First, an administrator must have applied an insecure configuration to an API proxy using the SetIntegrationRequest policy. Second, an attacker must send a specially crafted request to that proxy to trigger the flaw. Simply having the policy enabled is not enough; the bug does not trigger if the API proxy configuration is secured according to established best practices.

Why is this CVE relevant for my internet-facing services?

According to Halo Surface Signal, this vulnerability is highly relevant because Apigee is frequently deployed as an internet-facing gateway to manage public API traffic. If your Apigee instance is exposed to the internet, it serves as an entry point for potential attackers. Because the platform sits at the network edge, any misconfiguration here provides a direct path for unauthorized actors to attempt to exfiltrate tokens from your internal cloud environment.

Do I need to check my Apigee configurations now?

Yes, you should begin by identifying all API proxies that utilize the SetIntegrationRequest policy. Verify if these proxies are configured securely and evaluate whether they handle sensitive service account credentials. Work with your platform or application teams to review these specific settings, assess the potential business impact, and remediate any configurations that do not meet your organization's security standards.

References

docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.