CVE-2026-4764: Privilege Escalation in Dialogflow CX via Playbook Import

Synopsis

A missing authorization vulnerability in the playbook import functionality of Dialogflow CX on Google Cloud Platform allows an authenticated user to escalate privileges and take over the GCP project. The attack is reachable over the network and requires only a low-privilege account, with no victim interaction needed. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of both the Dialogflow CX service and the broader GCP project scope. A patched-image rebuild at fix version 2026-03-15 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Dialogflow CX API over the network; the vulnerable import endpoint is exposed as a standard over-the-network API surface.

• AuthenticationRequired

  A low-privilege GCP account with specific Dialogflow CX roles is sufficient; no admin credentials are needed to initiate the attack.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker submits the malicious playbook import directly.

• Attack complexityDetail

  Exploit complexity is low: the attack is reliable and requires no race conditions, special memory layout, or other environmental preconditions.

Blast Radius

• Attacker reads all data stored in the GCP project, including secrets, service-account keys, and customer records accessible to the project.
• Attacker modifies or deletes GCP project resources, including IAM bindings, storage buckets, and database contents.
• Attacker disrupts availability of Dialogflow CX agents and dependent GCP services within the project.
• Because the CVSS v4 subsequent-system scores are all High, attacker actions can propagate beyond Dialogflow CX to other services sharing the same GCP project identity.