Cases › security breach › LR-2026-0587
Google Vertex AI SDK flaw let attackers hijack model uploads via bucket squatting
Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report
Status: no action reported
No source states: loss or records, agent tool, could do, deployer, industry.
Severity minor: Test: minor, contained with no third party touched. Fact: Unit 42 said it saw no exploitation in the wild.
The Google Cloud Vertex AI SDK for Python, when a user did not set a staging bucket, generated a predictable Cloud Storage bucket name from the project ID and region and did not verify who owned it. An outside party could create that bucket first, have the SDK upload a model there, and replace it with a malicious one. When Vertex AI loaded the swapped model, the attacker's code ran in the serving container and could take an OAuth token. Palo Alto Networks Unit 42 found the flaw and reported it through Google's bug bounty program. Google shipped an initial fix in v1.144.0 and completed it in v1.148.0, adding bucket ownership verification. Unit 42 said it saw no exploitation in the wild.
What happened
What was done
No source states an action or fix.
Risks
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ApplicationVulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data
Infrastructure / targetKnown flaws patched · Intrusion and endpoint detection · Inventory of exposed services
Similar incidents
Evidence
No source states: what went wrong, what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 4 items from the primary sources
What happened, in order
- 2026-03-05 Unit 42 reported the flaw to Google through its Vulnerability Reward Program.
- 2026-03-31 Google shipped an initial fix in v1.144.0, adding a random uuid4 to the bucket name.
- 2026-04-15 Google completed the fix in v1.148.0, adding bucket ownership verification.
Not dated in the sources:
- Unit 42 tested versions 1.139.0 and 1.140.0 and found both vulnerable.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
No exploitation in the wild is reported. The tested-versions event is undated in the source. The Vertex AI Experiments CVE-2026-2473 mentioned in the source is a separate incident and is not reported.
LR-2026-0587 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON