Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting

Google Cloud Vertex AI SDK for Python contained a bug that let an attacker with their own Google Cloud project and the victim’s project ID hijack model uploads and get code to execute in Google’s model serving infrastructure. The issue is in the SDK’s default temporary Cloud Storage bucket handling, enabling cross-tenant model replacement (notably for pickle/joblib-based models) and theft of OAuth tokens from the serving container; Unit 42 reported the risk and Google patched it in v1.148.0 (update from versions such as 1.139.0 and 1.140.0). No CVE has been published for this specific problem as of the article’s publication, but users should upgrade and explicitly set staging_bucket to a bucket they control.