Skip to main content

Google CVE-2026-2473

Generation of Predictable Numbers or Identifiers (CWE-340)
2026-02-20 f45cbf4e-4146-4068-b7e1-655ffc2c548c GHSA-wh2j-26j7-9728
Google RCE

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 22:04 vuln.today
CVE Published
Feb 20, 2026 - 20:25 nvd
N/A

DescriptionCVE.org

Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).

This vulnerability was patched and no customer action is needed.

AnalysisAI

Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).

Technical ContextAI

Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).

This vulnerability was patched and no customer action is needed.

Affected ProductsAI

Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Pla

RemediationAI

Monitor vendor advisories for a patch.

Same weakness CWE-340 – Generation of Predictable Numbers or Identifiers

View all
CVE-2024-47945 CRITICAL POC
9.8
CVE-2025-15604 CRITICAL
9.8
CVE-2026-3256 CRITICAL
9.8
CVE-2026-11374 CRITICAL
9.0
CVE-2026-9733 CRITICAL
9.1
CVE-2026-5081 CRITICAL
9.1
CVE-2026-5085 CRITICAL
9.1
CVE-2026-42932 MEDIUM
6.9

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2026-2473 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy