High severityNVD Advisory· Published Feb 20, 2026· Updated Apr 15, 2026

CVE-2026-2473

Description

Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).

This vulnerability was patched and no customer action is needed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
google-cloud-aiplatformPyPI	>= 1.21.0, < 1.133.0	1.133.0

Affected products

osv-coords2 versions
pkg:apk/chainguard/airflow-2 pkg:pypi/google-cloud-aiplatform
< 2.11.0-r28+ 1 more
- (no CPE)range: < 2.11.0-r28
- (no CPE)range: >= 1.21.0, < 1.133.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-wh2j-26j7-9728ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-2473ghsaADVISORY
docs.cloud.google.com/support/bulletinsnvdWEB
github.com/googleapis/python-aiplatform/releases/tag/v1.133.0ghsaWEB

News mentions

Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting
The Hacker News · Jun 16, 2026

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000