CVE-2026-97030
EPSS 0.3%Vendor advisory-driven chatter; no PoC, no exploitation evidence; routine patch cycle.
What: Template escaping flaw in Apigee hybrid affecting 'yield' keyword handling; affects trusted template authors and downstream API gateway deployments.
Why it matters: Vendor (Google/Apigee) released v1.15.9 on October 21, 2026 with urgent patching across multiple components (watcher, runtime, redis, fluent-bit, istiod, cassandra-client). Social chatter is entirely vendor advisory noise—no PoC, no KEV listing, no defender triage reports or exploitation claims. EPSS 0.09 reflects low base exploitability, but patch urgency signals internal concern.
Where it's seen: Repetitive vendor security bulletins bundled with other CVEs across Apigee subcomponents; no independent researcher PoC or in-the-wild exploitation coverage.
RISK: MODERATE — Vendor patching urgently; template injection potential; but no active exploitation or KEV signal.
Description
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.