CVE-2026-2244

Sensitive Data Exposure in Google Cloud Vertex AI Workbench

State: Published
Severity: 8.4 High
Published: Feb 26, 2026
Updated: Feb 26, 2026
Reserved: Feb 9, 2026

Description

A vulnerability in Google Cloud Vertex AI Workbench from 7/21/2025 to 01/30/2026 allows an attacker to exfiltrate valid Google Cloud access tokens of other users via abuse of a built-in startup script.

All instances after January 30th, 2026 have been patched to protect from this vulnerability. No user action is required for this.

Scores

CVSS	Score	Vector	Source
4.0	8.4 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Clear	GoogleCloud

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
Vertex AI WorkbenchGoogle Cloud	7/21/2025 to before 01/30/2026Affected

References

https://docs.cloud.google.com/vertex-ai/docs/workbench/release-notes#February_20_2026

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.