Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting
A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with only their own Google Cloud project and the victim's often-public project ID hijack model uploads, because the SDK generated a predictable staging bucket name from the project ID and...