Token Exfiltration Vulnerability in Google Cloud Vertex AI Workbench

CVE-2026-2244

What is CVE-2026-2244?

A vulnerability in Google Cloud Vertex AI Workbench allows an attacker to exfiltrate valid Google Cloud access tokens of other users through the exploitation of a built-in startup script. This security flaw existed in instances deployed between July 21, 2025, and January 30, 2026. Following this date, instances have been patched to mitigate the risk of token abuse, ensuring that user credentials remain secure without requiring any action from users.

References