CVE-2026-3136 is a critical improper authorization flaw (CVSS 9.8) in GitHub Trigger Comment Control in Google Cloud Build. Google says it was patched on 26 January 2026 and that no customer action is needed. This post explains what it was and what to review anyway.
What's affected
Google Cloud Build before 2026-1-26, as written in the record. Cloud Build is a hosted service, so Google applied the fix on its side.
How to check if you're exposed
There is nothing to install. You can review how your own Cloud Build triggers are set up. In the Cloud Build console, open Triggers and look at any trigger that starts from GitHub pull requests and uses comment control.
Check which repositories feed those triggers and who can open pull requests against them.
What to do now
- No customer action is required, per Google's release note.
- Review Cloud Build triggers that run on pull requests from outside collaborators.
- Keep comment control set to require approval for builds from contributors you do not know.
- Use the least privileged service account for builds that run on untrusted code.
Why it matters
The weakness class is CWE-863, incorrect authorization. Comment control is meant to decide whether a pull request from an outside contributor may start a build. A gap in that decision could let a remote attacker run code in the build environment.
Build environments often hold secrets and deploy rights, so the check on who can start a build matters. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Do I need to do anything?
Google states that no customer action is needed. A review of your trigger settings is still good practice.
Sources
Last reviewed: 19 October 2026.
