CVE-2026-2473 json
Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.
published 2026-02-20 8 mo ago modified 2026-09-10 1 mo ago also GHSA-wh2j-26j7-9728 , PYSEC-2026-2500 , EUVD-2026-7506
- cvss
- 7.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).
This vulnerability was patched and no customer action is needed.
Patch / fix
- pypi google-cloud-aiplatform 1.133.0
- Google Cloud Vertex AI Experiments 1.133.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear |
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | google-cloud-aiplatform | >=1.21.0, <1.133.0 |
1.133.0 |
Affected products
- Google Cloud Vertex AI Experiments
Classification
- Weakness
-
- CWE-340 Generation of Predictable Numbers or Identifiers
References
-
docs.cloud.google.com
/support/bulletins#gcp-2026-012
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-2473
advisory
-
github.com
/googleapis/python-aiplatform
package
-
github.com
/googleapis/python-aiplatform/releases/tag/v1.133.0
web
-
pypi.org
/project/google-cloud-aiplatform
package
-
github.com
/advisories/GHSA-wh2j-26j7-9728
advisory
Sources
- CVE List CVE-2026-2473
- GitHub Advisory GHSA-wh2j-26j7-9728
- NVD CVE-2026-2473
- OSV PYSEC-2026-2500
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.