CVE-2026-19407

GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK

State: Published
Severity: 7.7 High
Published: Sep 15, 2026
Updated: Sep 21, 2026
Reserved: Aug 10, 2026

Description

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Clear	GoogleCloud

Weaknesses

CWE-330 Use of Insufficiently Random Values

Affected Products

Product	Versions
Gemini Enterprise Agent Platform SDK for PythonGoogle Cloud	1.16.0 to before 1.165.1Affected

References

https://docs.cloud.google.com/gemini-enterprise-agent-platform/release-notes#March_31_2026

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.