CVE-2026-19485: Bucket Squatting in Vertex AI Search for Commerce
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictable bucket names.
This vulnerability was patched and no customer action is needed.
Affected Software
Event History
Frequently Asked Questions
What information would an attacker need to target this issue?
An attacker would need to know the victim's Google Cloud project number. The issue involved predictable bucket names used for BigQuery import staging.
What data could have been exposed or modified?
An attacker could obtain read and write access to staged data and error logs associated with the affected BigQuery import staging process.
Do customers need to take remediation action?
No. The vulnerability was patched, and the provided information states that no customer action is needed.