Cloud Run MCP CVE-2026-85297

Exploitation requires the attacker to pre-register and control the predictable Google Cloud Storage bucket that Cloud Run MCP uses for staging source/artifacts before the legitimate tool claims it (bucket squatting, CWE-340), and requires a victim to deploy or operate through a vulnerable Cloud Run MCP instance (any version prior to 1.11.0). Limiting factors that reduce realistic risk below the raw CVSS reach: the target bucket must be unclaimed/predictable and squatted in advance (reflected as AT:P), and victim interaction is needed - a developer must actually run a deployment through the tool (UI:P). Only versions before 1.11.0 are affected; upgrading to 1.11.0+ removes the exposure. The exact algorithm that makes the bucket name predictable is not described in the available sources.

This is a genuinely high-severity issue (CVSS 4.0 base 7.7) but the real-world urgency is tempered by the attack preconditions, and the signals are mostly consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P) shows network reach and no authentication (PR:N), but two friction factors stand out: AT:P means a specific attack requirement must hold (the attacker must have pre-squatted the predictable Cloud Storage bucket the tool will use), and UI:P means a victim must passively act (deploy/use the MCP) for the attack to land. Impact is severe where it triggers - high confidentiality, integrity and availability on the vulnerable system (VC:H/VI:H/VA:H) with limited subsequent-system impact (SC:L/SI:L/SA:L), matching the described outcomes of source-code interception, arbitrary code execution and data exfiltration. The vuln.today decision label is 'this_week', not 'act_now' or 'emergency', which aligns with 'patch promptly but not a fire drill'. No EPSS score was supplied, so exploitation probability cannot be quantified; no CISA KEV listing and no public exploit reference were provided, so there is no evidence of active exploitation or available exploit code. Net: treat as a priority patch this week, driven by severity and the RCE/data-theft impact, rather than as an actively-exploited emergency - but note the missing EPSS data as a gap.

An attacker pre-registers (squats) the predictable Google Cloud Storage bucket name that Cloud Run MCP (versions < 1.11.0) relies on for staging source or artifacts. When a developer subsequently deploys through the vulnerable MCP, the attacker-controlled bucket intercepts the proprietary source code and can serve back malicious artifacts, leading to arbitrary code execution and data exfiltration. No public exploit identified at time of analysis.