We published a security bulletin for Apigee. A vulnerability was found in Apigee

## Security Security **On May 20, 2026, we published a security bulletin for Apigee.** A vulnerability was found in Apigee ([CVE-2026-2264](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2264)) where the `IntegrationRegion`parameter in the `SetIntegrationRequest` policy lacks validation, allowing for Server-Side Request Forgery (SSRF) and service account token exfiltration. The issue arises when an attacker can control a flow variable used for `IntegrationRegion`, leading to requests being sent to an attacker-controlled host with the service account token. **Security bulletin published: [GCP-2026-034](https://cloud.google.com/apigee/docs/security-bulletins/security-bulletins#gcp-2026-034)**