Executive brief
Google Cloud Vertex AI is a machine learning platform used by enterprises to train and deploy AI models. A vulnerability in the Python SDK allowed attackers to intercept model uploads by predicting and creating staging buckets in advance, then replacing legitimate models with poisoned versions to achieve remote code execution. The flaw affected versions 1.139.0 through 1.147.x and has been patched in version 1.148.0 released April 15, 2026.
Technical details
The vulnerability is a bucket-squatting attack enabled by predictable resource names in the Vertex AI SDK for Python (google-cloud-aiplatform). When users upload ML models without specifying a custom staging bucket, the SDK constructs bucket names using a deterministic pattern based on project ID and region. An attacker knowing the victim's project ID can preemptively create this bucket in their own Google Cloud project. The SDK then silently uploads model artifacts to the attacker-controlled bucket, missing an ownership verification check. Within a narrow window, the attacker replaces the legitimate model with a malicious pickle-serialized version. When the victim deploys the compromised model, the P4SA service account loads the poisoned artifact, triggering pickle deserialization and executing arbitrary code within the victim's Vertex AI infrastructure. No initial access to the victim's project is required; the attack is purely network-based and can lead to data exfiltration and lateral movement. Google released a fix in SDK version 1.148.0 on April 15, 2026.
Affected products
- Google Cloud Vertex AI SDK for Python 1.139.0 through 1.147.x
Timeline
- 2026-06-16: disclosed: Palo Alto Networks Unit 42 published research on 'Pickle in the Middle' attack
- 2026-04-15: patched: Google released fix in google-cloud-aiplatform SDK version 1.148.0
- 2026-08-26: advisory: CVE-2026-19485 published on NVD