Vulnerability  ·  2026-09-16

Google Cloud Gemini Enterprise Agent Platform SDK — bucket-squatting RCE and tenant token theft

VulnerabilityHigh impactGlobalCVE-2026-19407
A predictable Cloud Storage bucket-naming pattern in the Gemini Enterprise Agent Platform Python SDK allows an unauthenticated attacker to pre-claim a bucket a victim tenant will later use, achieving cross-tenant remote code execution and tenant-project token theft — the third publicly disclosed bucket-squatting flaw in this SDK family in 2026.
Google Cloud's Gemini Enterprise Agent Platform is a widely deployed managed AI-agent/ML platform; a cross-tenant RCE plus token-theft primitive in its own SDK threatens any organization building agents, training pipelines, or notebooks on the platform with unpatched SDK versions, and the recurrence of the same architectural bug (GeminiSquat, MountSquat, VertexSquat, and now this) signals a systemic naming-convention weakness rather than an isolated defect.
The SDK relies on predictable, non-tenant-scoped Cloud Storage bucket naming. An attacker can pre-create a bucket at the predictable name before a victim tenant does ('bucket squatting'), causing the victim's SDK workflow to read/write through the attacker-controlled bucket — enabling remote code execution in the victim's environment and theft of tenant-project access tokens.
Google Cloud Gemini Enterprise Agent Platform SDK for Python, versions prior to 1.166.1
Update to google-cloud-aiplatform / Gemini Enterprise Agent Platform SDK for Python 1.166.1 or later. This is the same architectural weakness class as prior disclosed 'GeminiSquat' and 'VertexSquat' bucket-squatting bugs in the same SDK family, so operators should audit all pinned SDK versions across notebooks, CI jobs, and training pipelines, not just production.
NVDGoogle Cloud Gemini Enterprise Agent Platform Release Notes
See this in the live feed Explore related AI security and governance findings — updated every morning.
Open the feed →