Live › vulnerability › CVE-2026-85297
Go to dashboardCloud Run MCP versions before 1.11.0 are exposed to bucket squatting, where an attacker can take over a storage bucket the tool expects to exist. The sources say an attacker can then intercept and read proprietary source code, execute arbitrary code, and exfiltrate data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
Teams running Google Cloud Run MCP below version 1.11.0 on Google Cloud Platform. The sources do not say which configurations make a deployment exposed beyond the version, so the bucket ownership check is the practical test.
No product ranges from the sources yet.
1.11.01.11.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.
Users must upgrade to Cloud Run MCP version 1.11.0 or later.
This page as .md · .json · in your agent: get_signal("CVE-2026-85297")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.