CVE-2026-1727: Information Disclosure via Bucket Squatting in Google Cloud Agentspace.
The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage bucket names. These names were utilized for error logs and temporary staging during data imports from GCS and Cloud SQL. This predictability allowed an attacker to engage in "bucket squatting" by establishing these buckets before a victim's initial use.
All versions after December 12th, 2025 have been updated to protect from this vulnerability. No user action is required for this.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1727?
CVE-2026-1727 has been categorized with a medium severity rating due to the risk of sensitive information disclosure.
How do I fix CVE-2026-1727?
To mitigate CVE-2026-1727, ensure that the Google Cloud Storage bucket names are randomized and not predictable.
What types of information are exposed by CVE-2026-1727?
CVE-2026-1727 can expose sensitive information such as error logs and temporary staging data associated with Google Agentspace.
Which software versions are affected by CVE-2026-1727?
CVE-2026-1727 affects Google Agentspace versions up to December 12, 2025.
Is there a workaround for CVE-2026-1727?
A recommended workaround for CVE-2026-1727 is to review and secure any bucket names used in Google Cloud Storage to prevent predictability.