CVE-2026-85297

Cloud Run MCP bucket squatting can expose deployment source

Google Cloud · Cloud Run MCP

First documented disclosure · Review checkpoint

Summary

A deployment could use a storage bucket controlled by another party.

Severity and exploitation evidence

High · 7.7/10 · CVSS 4.0. Severity source.

Exploitation not established: No malicious exploitation or customer compromise is established by the reviewed sources.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Predictable bucket selection did not adequately verify that an existing bucket belonged to the intended project.

Conditions required

An attacker-controlled matching bucket and an affected deployment that uses it; the CNA specifies additional attack conditions and passive user interaction.

Potential impact

Potential source-code interception, code execution and data theft under the deployment's authority.

Affected versions and configurations

Before 1.11.0.

Fix and mitigation status

1.11.0.

Practical next steps

Upgrade and verify storage ownership and least-privilege deployment identities.

Operating lesson

A globally unique resource name does not prove ownership by the intended project.

Evidence and limits

The July 14 public ownership-check PR and same-day security review predate the September 28 release and October 26 CVE. This is a tool vulnerability, not an established breach of the Cloud Run service.

Sources