CVE-2026-2473: 
Chainguard vulnerability analysis and mitigation

CVE-2026-2473 is a predictable bucket naming vulnerability in Google Cloud Vertex AI Experiments that allows unauthenticated remote attackers to achieve cross-tenant remote code execution, model theft, and model poisoning via a "Bucket Squatting" attack. It affects the google-cloud-aiplatform Python package (pip) from version 1.21.0 up to (but not including) 1.133.0. The vulnerability was published on February 20, 2026, and a patch was released in version 1.133.0 with no additional customer action required. It carries a CVSS v4 base score of 7.7 (High) (GitHub Advisory).

The root cause is classified as CWE-340 (Generation of Predictable Numbers or Identifiers): Vertex AI Experiments generates Cloud Storage bucket names in a predictable, guessable manner, allowing an attacker to determine the bucket name before it is created by a legitimate user or service. An attacker can exploit this by pre-registering ("squatting") the predictably named GCS bucket in their own Google Cloud project before the victim's Vertex AI Experiment initializes. When the victim's experiment runs, it interacts with the attacker-controlled bucket instead of a legitimate one, enabling code injection, data exfiltration, or model tampering across tenant boundaries. No privileges are required by the attacker, though some passive user interaction (a victim initiating an experiment) is needed to trigger the cross-tenant impact (GitHub Advisory).

Successful exploitation enables an unauthenticated remote attacker to achieve cross-tenant remote code execution on Google Cloud Platform, steal proprietary ML models, and poison model training data or artifacts. Because the attack operates at the storage layer shared across tenants, it can affect any organization using Vertex AI Experiments within the vulnerable version range, with high confidentiality, integrity, and availability impact to the vulnerable system. The cross-tenant nature of the attack means a single malicious actor could potentially target multiple victim organizations simultaneously (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). No threat actor attribution has been reported. The EPSS score is approximately 0.27–0.31%, placing it around the 55th percentile for exploitation probability within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication and low complexity, but does require the attacker to predict and pre-register the bucket name before the victim initiates an experiment (GitHub Advisory).

1. Reconnaissance: Identify the bucket naming scheme used by Vertex AI Experiments by reviewing public documentation, open-source code in the googleapis/python-aiplatform repository, or by creating a test Vertex AI Experiment in a controlled environment to observe the generated bucket name pattern.
2. Predict target bucket name: Using knowledge of the naming algorithm (e.g., based on project ID, region, or experiment name), compute the expected GCS bucket name that a target organization's Vertex AI Experiment will attempt to use.
3. Pre-create (squat) the bucket: Using a Google Cloud account (free tier or otherwise), create a Cloud Storage bucket with the predicted name in the appropriate region before the victim's experiment initializes.
4. Plant malicious content: Upload malicious code, poisoned model artifacts, or data-exfiltration scripts into the pre-created bucket, designed to execute or be consumed when the victim's Vertex AI Experiment accesses the bucket.
5. Wait for victim interaction: When the victim initiates a Vertex AI Experiment, the platform directs it to the attacker-controlled bucket, resulting in cross-tenant remote code execution, model theft, or model poisoning (GitHub Advisory).

• Cloud Storage: Unexpected or unauthorized GCS buckets with names matching Vertex AI Experiments naming patterns, owned by unknown projects or accounts.
• Logs: Vertex AI Experiment logs showing access to GCS buckets not owned by the expected project; GCS audit logs indicating bucket creation by an external account prior to experiment initialization.
• Network: Outbound data transfers from Vertex AI Experiment jobs to unexpected GCS bucket owners or external endpoints.
• Model Artifacts: Unexpected modifications to model files, training data, or experiment outputs stored in GCS; checksums or hashes of model artifacts not matching expected values.

Google has patched this vulnerability in google-cloud-aiplatform version 1.133.0. Users should upgrade to version 1.133.0 or later using pip install --upgrade google-cloud-aiplatform. Google has stated that no additional customer action is required beyond applying the patched version, as the fix resolves the predictable bucket naming issue at the library level. Organizations can verify their installed version with pip show google-cloud-aiplatform (GitHub Advisory, GCP Security Bulletin).

Google acknowledged the vulnerability via its Cloud Security Bulletin (GCP-2026-012) and confirmed that the patch was applied server-side with no customer action required beyond upgrading the SDK. The advisory was reviewed and published by GitHub's security team on the same day as NVD publication (February 20, 2026). No significant independent researcher commentary or broad media coverage has been identified at this time (GitHub Advisory, GCP Security Bulletin).