Loading vulnerability…
WSSnatch
WSSnatch is a Cross-Site WebSocket Hijacking vulnerability in Google Cloud Platform Cloud Shell before July 22, 2026. Missing Origin validation on the WebSocket TCP tunnel, cross-site transmission of authentication cookies, and unrestricted forwarding to internal ports allow an unauthenticated attacker-controlled website to establish a WebSocket authenticated as an active Cloud Shell user. The tunnel exposes an internal metadata proxy that returns the user's OAuth access token, enabling session hijacking and token exfiltration. Google assigned the vulnerability a CVSS v4.0 score of 8.7 (High).
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises an active Cloud Shell session and exposes the user's OAuth bearer token. In demonstrated testing, the token permitted Google Cloud API access within the victim's existing IAM permissions, viewing and managing Google Drive files, and access to email-address and profile information. The token response reported a 3,600-second lifetime. Exploitation does not inherently grant additional IAM privileges, and the demonstrated scopes did not establish Gmail access, password takeover, or account-recovery control. No confirmed malicious exploitation is established.
If you can’t patch tonight, do this now.
No interim customer workaround is specified. Google has patched the managed service and states that no customer action is needed.
Patch, then assume compromise.
Google deployed a service-side patch on July 22, 2026. The fixes introduced stricter WebSocket Origin validation and allowed-port lists for TCP and SSH tunnels. No customer upgrade or other action is required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.