CVE-2026-3259

CVE-2026-3259 is an information disclosure vulnerability in Google BigQuery's Materialized View Refresh mechanism that allows authenticated users to extract sensitive data by crafting a materialized view designed to trigger runtime errors during the refresh process. The vulnerability affects Google Cloud Platform users leveraging the BigQuery service. The attack requires valid authentication credentials and moderate complexity to exploit, as it necessitates the creation of a specifically engineered materialized view to generate error messages containing sensitive information. The primary risk is unauthorized disclosure of confidential data that may be revealed in error output, though the attack surface is limited to authenticated users with appropriate BigQuery access. There is no evidence of active exploitation or public exploit code availability. The vulnerability has not been designated for the Known Exploited Vulnerabilities catalog, and community attention appears minimal. Google patched this issue on January 29, 2026, with no required customer remediation, indicating the fix was implemented transparently on the service side.