Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE
2026-06-16T20:51:37Z•186ec975f471036ea6871c87fe62afbde85a471ccad66868f90612c49437f686
bucket-squattingcloud-securitycross-tenantgcsgoogle-cloudinsecure-deserializationpicklepythonrceremote-code-executionsdksupply-chainunit42vertex-aivulnerability
What happened
Unit 42 disclosed a vulnerability in the Google Vertex AI Python SDK where model uploads can be hijacked via bucket squatting and insecure deserialization (pickle), enabling cross-tenant remote code execution. An attacker who controls or precreates a storage bucket used during model upload can cause victim tenants to load malicious pickled objects, resulting in arbitrary code execution on Vertex AI workloads. This impacts model upload/serving flows that accept or load pickled artifacts.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- 186ec975f471036ea6871c87fe62afbde85a471ccad66868f90612c49437f686
- Enrichment time
- 2026-06-16T20:51:37Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.