Skip to content
OpenAdvisories
High · 7.7 CVE-2026-85297 EUVD-2026-109906GHSA-cg86-fr78-hv98

Bucket Squatting in Cloud Run MCP leads to Service Account Takeover

Published Oct 26, 2026 · Updated Nov 2, 2026 · Assigned by GoogleCloud

Description

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.

Users must upgrade to Cloud Run MCP version 1.11.0 or later.

Affected products

VendorProductAffectedFixed
Google Cloud Cloud Run MCP < 1.11.0 1.11.0

References