CVE-2026-19407

A bucket-squatting flaw (CWE-330, use of insufficiently random values) in the Google Cloud Gemini Enterprise Agent Platform SDK for Python, in all versions prior to 1.166.1, allows an attacker to pre-register a Google Cloud Storage bucket whose name the SDK derives in a predictable way. When a victim runs the SDK and it resolves content from the attacker-controlled bucket, the malicious payload executes in the victim's environment, yielding remote code execution. Because the SDK operates with the tenant's credentials, successful exploitation can additionally expose tokens scoped to the victim's Google Cloud tenant project. The attack is network-reachable and requires no privileges, but CVSS 4.0 (7.7, high) indicates user interaction and attack prerequisites are needed. No public proof of concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported; the fix ships in version 1.166.1.

What to do: Upgrade the Python SDK to version 1.166.1 or later as soon as possible. Verify that any Google Cloud Storage buckets the SDK uses for artifacts or state are pre-created and owned by your organization rather than auto-named, and review Cloud Audit Logs for buckets or artifacts you did not create. If vulnerable versions ran with privileged service accounts, rotate those credentials and investigate for stolen tenant-project tokens or unexpected code execution.