CVE-2026-2473

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2473", "assignerOrgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "state": "PUBLISHED", "assignerShortName": "GoogleCloud", "dateReserved": "2026-02-13T15:41:59.549Z", "datePublished": "2026-02-20T19:39:51.015Z", "dateUpdated": "2026-02-23T19:54:20.923Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Vertex AI Experiments", "vendor": "Google Cloud", "versions": [{"lessThan": "1.133.0", "status": "affected", "version": "1.21.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Omer Amiad"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(239, 250, 102);\"><span style=\"background-color: rgb(255, 255, 255);\">Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to&nbsp;(but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).</span></span><span style=\"background-color: rgb(255, 255, 255);\"><br></span><span style=\"background-color: rgb(255, 255, 255);\"><br>This vulnerability was patched and no customer action is needed.</span><br>"}], "value": "Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to\u00a0(but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).\n\nThis vulnerability was patched and no customer action is needed."}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "shortName": "GoogleCloud", "dateUpdated": "2026-02-20T19:39:51.015Z"}, "references": [{"url": "https://docs.cloud.google.com/support/bulletins#gcp-2026-012"}], "source": {"discovery": "EXTERNAL"}, "tags": ["exclusively-hosted-service"], "title": "Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T19:52:07.113995Z", "id": "CVE-2026-2473", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:54:20.923Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2473", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-23T19:52:07.113995Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:52:32.652Z"}}], "cna": {"tags": ["exclusively-hosted-service"], "title": "Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Omer Amiad"}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "CLEAR", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Google Cloud", "product": "Vertex AI Experiments", "versions": [{"status": "affected", "version": "1.21.0", "lessThan": "1.133.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.cloud.google.com/support/bulletins#gcp-2026-012"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to\u00a0(but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).\n\nThis vulnerability was patched and no customer action is needed.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(239, 250, 102);\"><span style=\"background-color: rgb(255, 255, 255);\">Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to&nbsp;(but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).</span></span><span style=\"background-color: rgb(255, 255, 255);\"><br></span><span style=\"background-color: rgb(255, 255, 255);\"><br>This vulnerability was patched and no customer action is needed.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers"}]}], "providerMetadata": {"orgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "shortName": "GoogleCloud", "dateUpdated": "2026-02-20T19:39:51.015Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2473", "state": "PUBLISHED", "dateUpdated": "2026-02-23T19:54:20.923Z", "dateReserved": "2026-02-13T15:41:59.549Z", "assignerOrgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "datePublished": "2026-02-20T19:39:51.015Z", "assignerShortName": "GoogleCloud"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Vertex AI Experiments", "vendor": "Google Cloud", "versions": [{"lessThan": "1.133.0", "status": "affected", "version": "1.21.0", "versionType": "custom"}]}], "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}], "cveTags": [{"sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "tags": ["exclusively-hosted-service"]}], "descriptions": [{"lang": "en", "value": "Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to\u00a0(but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).\n\nThis vulnerability was patched and no customer action is needed."}, {"lang": "es", "value": "Nombres de buckets predecibles en Vertex AI Experiments en Google Cloud Vertex AI desde la versi\u00f3n 1.21.0 hasta (pero sin incluir) la 1.133.0 en Google Cloud Platform permite a un atacante remoto no autenticado lograr ejecuci\u00f3n remota de c\u00f3digo entre inquilinos, robo de modelos y envenenamiento mediante la creaci\u00f3n previa de buckets de Cloud Storage con nombres predecibles (Bucket Squatting).\n\nEsta vulnerabilidad fue parcheada y no se requiere ninguna acci\u00f3n por parte del cliente."}], "id": "CVE-2026-2473", "lastModified": "2026-06-17T10:31:08.043", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2473", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T19:52:07.113995Z", "version": "2.0.3"}}]}, "published": "2026-02-20T20:25:24.497", "references": [{"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "url": "https://docs.cloud.google.com/support/bulletins#gcp-2026-012"}], "sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-340"}], "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.21.0,1.133.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Vertex AI Experiments", "source": "cna", "vendor": "Google Cloud"}, "product": "vertex_ai_experiments", "vendor": "google_cloud"}], "analysis": {"en": {"generated_at": "2026-04-18T11:28:20.518189+00:00", "value": {"mitigation_remediation": ["Monitor Cloud Storage for unexpected bucket creation events that match faulty naming patterns.", "Apply stricter IAM policies to limit bucket creation and naming rights to trusted accounts only.", "Enable Cloud Audit Logging for bucket creation events to detect suspicious activity."], "summary": {"action": "No action", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Google Cloud Vertex AI Experiments versions 1.21.0 through 1.133.0 (excluding 1.133.0) are affected. Any tenant using these versions is susceptible.", "description_and_impact": "An attacker can pre\u2011create predictably named Cloud Storage buckets to exploit predictable bucket naming in Google Cloud Vertex AI Experiments versions 1.21.0 to 1.133.0. By doing so, the attacker can gain cross\u2011tenant remote code execution, steal trained models, or poison models running on other tenants' data. The weakness is a predictable naming scheme that lacks proper authorization checks, documented as CWE\u2011340.", "risk_and_exploitability": "The CVSS base score is 7.7, indicating moderate severity, while the EPSS score is less than 1%, implying a very low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attacks can be launched without prior authentication by creating buckets with predictable names. Google has patched the issue; no customer action is required at this time."}}}}, "created": "2026-02-23T14:35:15.655515+00:00", "updated": "2026-04-18T11:30:44.326259+00:00", "vendors": ["google_cloud", "google_cloud$PRODUCT$vertex_ai_experiments"]}