CVE-2026-85297

Bucket Squatting in Cloud Run MCP leads to Service Account Takeover

State: Published
Severity: 7.7 High
Published: Oct 26, 2026
Updated: Oct 26, 2026
Reserved: Sep 3, 2026

Description

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.

Users must upgrade to Cloud Run MCP version 1.11.0 or later.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber	GoogleCloud

Weaknesses

CWE-340 Generation of Predictable Numbers or Identifiers

Affected Products

Product	Versions
Cloud Run MCPGoogle Cloud	before 1.11.0Affected

References

https://github.com/GoogleCloudPlatform/cloud-run-mcp/releases/tag/v1.11.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.