Default Vertex AI Buckets Can Cross Tenant Boundaries
The safe-looking default is the weak point. If the SDK picks the staging bucket for you, its predictable name can be claimed by a different Google Cloud project, and a model upload can end up under attacker control instead of the uploader's. The standard check, that the bucket exists, misses the real question: who owns it.
Unit 42 says the flaw affects the Google Cloud Vertex AI Python SDK, including google-cloud-aiplatform 1.139.0 and 1.140.0, and Google fixed it in v1.148.0 on April 15, 2026. In the vulnerable flow, a user who leaves staging_bucket unset can have model artifacts routed to a bucket name an attacker pre-created, which can let a swapped model execute inside Vertex AI serving infrastructure.
The result is a cloud supply-chain problem inside the model upload path. Deterministic defaults are only safe if ownership is verified, and this one was not.