CVE-2026-19407

Bucket squatting in GCP Gemini SDK <1.166.1 enables RCE and tenant token theft.

• CVSS 7.7
• 330
• Authentication, Authorization, and Session Management
• Remote

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft.

CVE

CVE-2026-19407

CWE

330

CVSS base score

7.7

Published

2026-09-15

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Python

Fixed by upgrading

Yes

Solution

Upgrade the Google Cloud Gemini Enterprise Agent Platform SDK for Python to version 1.166.1 or newer.

import re
from google.cloud import gemini_v1

def get_project_token(bucket_name: str) -> str:
    # VULNERABLE: unsanitized bucket name allows bucket squatting
    client = gemini_v1.GeminiAgentServiceClient()
    request = gemini_v1.GetProjectTokenRequest(bucket=bucket_name)
    response = client.get_project_token(request)
    return response.token

import re
from google.cloud import gemini_v1

def get_project_token(bucket_name: str) -> str:
    # FIX: enforce strict bucket name pattern to prevent squatting
    if not re.fullmatch(r"[a-z0-9_.-]{3,63}", bucket_name):
        raise ValueError("Invalid bucket name")
    client = gemini_v1.GeminiAgentServiceClient()
    request = gemini_v1.GetProjectTokenRequest(bucket=bucket_name)
    response = client.get_project_token(request)
    return response.token

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202619407,
  title        = {{Bucket squatting in GCP Gemini SDK <1.166.1 enables RCE and tenant token theft.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-19407},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-19407/}}
}