CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce
Attackers can access staged data and logs via predictable bucket names in Vertex AI Search for Commerce.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19485?
CVE-2026-19485 is a critical vulnerability in Google Cloud Vertex AI Search for Commerce, published on 26 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictable bucket names.
This vulnerability was patched and no customer action is needed.
Weakness: CWE-330
Which versions are affected by CVE-2026-19485?
How do I fix CVE-2026-19485?
No fix has been published for CVE-2026-19485 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-19485 being exploited?
There is no known exploitation of CVE-2026-19485 in the wild and no public exploit code.
Sources
Also known as GHSA-5mff-2rmc-p8x8.