CVE-2026-85297
Awaiting Analysis Awaiting Analysis - Queue

Bucket Squatting in Google Cloud Run MCP

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GoogleCloud

Description
Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-85297
EUVD
EUVD-2026-109906

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Google Cloud Cloud Run MCP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-340 The product uses a scheme that generates numbers or identifiers that are more predictable than required.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 allows an attacker to intercept and access proprietary source code, execute arbitrary code, and exfiltrate data by exploiting improper bucket ownership checks.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data, potential execution of malicious code, and theft of proprietary information. Users should upgrade to Cloud Run MCP version 1.11.0 or later to mitigate risks.

Mitigation Strategies

Upgrade to Cloud Run MCP version 1.11.0 or later to address the bucket squatting vulnerability and prevent unauthorized access to source code and data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85297. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart