Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting
Summary: A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with only their own Google Cloud project and the victim's often-public project ID hijack model uploads, because the SDK generated a predictable staging bucket name from the project ID and region and checked that the bucket existed but not who owned it. Palo Alto Networks Unit 42, which reported the bug on March 5, 2026 and calls the technique "Pickle in the Middle," showed a Cloud Function replacing the uploaded model in 1.4 seconds before Vertex AI read it, executing attacker code in the serving container; Google added a random uuid4 in v1.144.0 on March 31 and completed the fix with bucket ownership verification in v1.148.0 on April 15.
What's compelling: The stolen OAuth token was not confined to the compromised deployment in Unit 42's test environment - it reached other model artifacts in the same Google-managed tenant project, including a full TensorFlow model with trained weights, plus BigQuery metadata, access lists, tenant logs, and GKE cluster names. This is the second predictable-bucket-name flaw in Vertex AI this year, after CVE-2026-2473 was patched in February.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-2473
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026