Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE
Summary: Unit 42 found a vulnerability in Google Cloud's Vertex AI Python SDK (google-cloud-aiplatform versions 1.139.0 and 1.140.0) that let an attacker working from their own Google Cloud project hijack a victim's model upload with no initial access to the victim's project. The SDK builds a staging bucket name deterministically from the project ID and region and checks only whether the bucket exists, not who owns it, so an attacker can squat the name and replace the uploaded model with a pickle payload that executes code when the model is deployed; Google fixed the issue in v1.148.0, released April 15, 2026.
Why it matters: The attacker's Cloud Function replaced the model in about 1.4 seconds, inside a roughly 2.5-second window before the AI Platform Service Agent read the artifact, and the payload then queried the GCE metadata server for the serving container's service account credentials and exfiltrated them.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026