CVE-2026-2473: Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.
Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).
This vulnerability was patched and no customer action is needed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2473?
CVE-2026-2473 has been rated as a high severity vulnerability due to the potential for remote code execution and model theft.
How do I fix CVE-2026-2473?
To fix CVE-2026-2473, upgrade Google Cloud Vertex AI to version 1.133.0 or later.
What types of attacks can CVE-2026-2473 facilitate?
CVE-2026-2473 can facilitate cross-tenant remote code execution, model theft, and model poisoning.
Which versions of Google Cloud Vertex AI are affected by CVE-2026-2473?
Google Cloud Vertex AI versions from 1.21.0 up to but not including 1.133.0 are affected by CVE-2026-2473.
Is authentication required to exploit CVE-2026-2473?
No, CVE-2026-2473 can be exploited by unauthenticated remote attackers.