Google Cloud Vertex AI SDK flaw enabled cross-tenant remote code execution

Google Cloud Vertex AI's Python software development kit contained a design flaw that let a remote attacker run arbitrary code across tenant boundaries, Palo Alto Networks Unit 42 disclosed on June 16, 2026. The researchers named the technique "Pickle in the Middle" and reported it to Google on March 5, 2026; Google acknowledged top severity by March 10 and shipped fixes before the public write-up.

What made the flaw dangerous is that it needed no stolen credentials. The SDK built its staging bucket name from a deterministic pattern using the project ID and region, checked whether the bucket existed, but never verified who owned it. An attacker who knew a victim's Google Cloud project ID could pre-register the predicted bucket name in their own project.

From there, Unit 42 demonstrated an attacker-controlled Cloud Function that replaced the legitimate model artifact with a malicious pickle payload in roughly 800 milliseconds, inside the race window the model upload created. The payload used Python's joblib.load() to execute code on load. In the proof of concept, it exfiltrated OAuth tokens, the project number, the endpoint ID and Kubernetes metadata, enabling cross-deployment model theft and BigQuery reconnaissance.

The issue affected google-cloud-aiplatform versions 1.139.0 and 1.140.0. Google's v1.144.0, released March 31, 2026, introduced randomized bucket naming, and v1.148.0 on April 15 added explicit bucket-ownership verification. Unit 42 recommends upgrading to v1.148.0 or later and setting the staging_bucket parameter explicitly.

The vulnerability was patched before disclosure, and there is no public report of exploitation in the wild. No official Google Security Blog post had confirmed the findings at the time of collection, and the account here rests on the Unit 42 research.