Bucket Squatting Vulnerability in Google Cloud Run by Google
CVE-2026-85297

7.7HIGH

Key Information:

Vendor: Google Cloud
Status: Cloud Run Mcp
Vendor: CVE Published:; 26 October 2026

🔔 Create Google Cloud Vulnerability Alert

What is CVE-2026-85297?

A vulnerability in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows malicious actors to engage in bucket squatting, enabling them to intercept proprietary source code, execute arbitrary code, and exfiltrate sensitive data. To mitigate this risk, users are advised to upgrade to Cloud Run MCP version 1.11.0 or later.

Affected Version(s)

Cloud Run MCP 0 < 1.11.0

References

https://github.com/GoogleCloudPlatform/cloud-run-mcp/rele...

CVSS V4

Score:

7.7

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 26, 2026
Vulnerability Reserved
Sep 3, 2026

Credit

lambdasawa (Tsubasa Irisawa)

CVE-2026-85297 Data

JSON