Executive brief
The Google Cloud Gemini Enterprise Agent Platform SDK for Python is a library used to interact with Google's AI agent and model services. Versions prior to 1.166.1 are vulnerable to bucket squatting, which allows an attacker to perform remote code execution and steal authentication tokens belonging to the tenant project. This could enable an attacker to compromise deployed agents, exfiltrate sensitive data, or move laterally within a Google Cloud environment.
Technical details
The vulnerability is a bucket squatting issue in the Python SDK for Gemini Enterprise Agent Platform prior to version 1.166.1. Bucket squatting typically involves exploiting namespace resolution or package discovery mechanisms to inject malicious content. An attacker can achieve remote code execution by registering or controlling a resource with a name similar to one expected by the SDK, leading to code execution in the context of the application. The attack also enables theft of tenant-project authentication tokens. No authentication or special privileges are required from the attacker's perspective if the SDK can be tricked into accessing attacker-controlled resources. The vulnerability has been fixed in version 1.166.1 and later.
Affected products
- Google Cloud Gemini Enterprise Agent Platform SDK for Python prior to 1.166.1
Timeline
- 2026-09-15: disclosed