Google Cloud’s hidden proto endpoint gave attackers full remote code execution
A public debugging endpoint in Google Cloud’s production API exposed internal protobuf definitions, letting researchers pull any service’s request and response schemas. Leveraging this, the author achieved full remote code execution, prompting CVE‑2026‑2031 and a $148,337 bounty. The flaw shows how seemingly harmless introspection APIs can open massive attack surfaces.