CVE-2026-19407 — GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK

CVE-2026-19407

GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK PUBLISHED

Description (CNA)

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft.

Affected (CNA)

Vendor / product	Versions
Google Cloud / Gemini Enterprise Agent Platform SDK for Python	affected 1.16.0 before 1.165.1

CWE

CWE-330

References

https://docs.cloud.google.com/gemini-enterprise-agent-platform/release-notes#March_31_2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.