Vulnerabilities · 90 days ago

Default Vertex AI Buckets Can Cross Tenant Boundaries

The safe-looking default is the weak point. If the SDK picks the staging bucket for you, its predictable name can be claimed by a different Google Cloud project, and a model upload can end up under attacker control instead of the uploader's. The standard check, that the bucket exists, misses the real question: who owns it.

Unit 42 says the flaw affects the Google Cloud Vertex AI Python SDK, including google-cloud-aiplatform 1.139.0 and 1.140.0, and Google fixed it in v1.148.0 on April 15, 2026. In the vulnerable flow, a user who leaves staging_bucket unset can have model artifacts routed to a bucket name an attacker pre-created, which can let a swapped model execute inside Vertex AI serving infrastructure.

The result is a cloud supply-chain problem inside the model upload path. Deterministic defaults are only safe if ownership is verified, and this one was not.

CVE-2026-2473

NVD KEV

EPSS 0.4% (35th percentile).

Timeline

Jun 17 Reported by The Hacker News
Jun 16 Reported by Unit 42

Sources

2 sources covering this story

The Hacker News Jun 17
Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting
Google fixed a Vertex AI SDK flaw in v1.148.0 after Unit 42 showed bucket squatting could enable model hijacking and code execution.
Unit 42 Jun 16
Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE
Unit 42 discovered a Vertex AI Python SDK vulnerability that allows remote code execution via bucket squatting.

Entities

CVE-2026-2473

Part of the PlainSec briefing for 2026-06-16

Editions

Briefing for 2026-06-16

Vulnerabilities · 90 days agoDefault Vertex AI Buckets Can Cross Tenant BoundariesThe safe-looking default is the weak point. If the SDK picks the staging bucket for you, its predictable name can be claimed by a different Google Cloud project, and a model upload can end up under attacker control instead of the uploader's. The standard check, that the bucket exists, misses the real question: who owns it.Unit 42 says the flaw affects the Google Cloud Vertex AI Python SDK, including google-cloud-aiplatform 1.139.0 and 1.140.0, and Google fixed it in v1.148.0 on April 15, 2026. In the vulnerable flow, a user who leaves staging_bucket unset can have model artifacts routed to a bucket name an attacker pre-created, which can let a swapped model execute inside Vertex AI serving infrastructure.The result is a cloud supply-chain problem inside the model upload path. Deterministic defaults are only safe if ownership is verified, and this one was not.