CVE-2026-2473highCWE-340

CVE-2026-2473: falha de alta gravidade em Google Cloud Vertex AI Experiments

Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Vertex AI Experiments+ Monitorar google-cloud-aiplatform

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.5%
Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting). This vulnerability was patched and no customer action is needed.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear
Produtos afetados
Google Cloud · Vertex AI Experiments