CVE-2026-19485 — Bucket Squatting in Vertex AI Search for Commerce

CVE-2026-19485

Bucket Squatting in Vertex AI Search for Commerce PUBLISHED

Description (CNA)

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictable bucket names. This vulnerability was patched and no customer action is needed.

Affected (CNA)

Vendor / product	Versions
Google Cloud / Vertex AI Search for Commerce	affected 0 before 2026-04-27

CWE

CWE-330

References

https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.