---
id: "CVE-2026-85297"
kind: "vulnerability"
aliases: ["CVE-2026-85297"]
title: "Google Cloud Run MCP: bucket squatting lets attackers run code and read source"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "cloud-run", "gcp", "google-cloud", "mcp"]
not_affected_if: ["version-1.11.0-or-later"]
published_at: "2026-10-26T16:17:23+00:00"
first_seen_at: "2026-10-26T16:31:01+00:00"
updated_at: "2026-10-26T16:32:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85297", "first_seen_at": "2026-10-26T16:31:01+00:00"}]
---

# Google Cloud Run MCP: bucket squatting lets attackers run code and read source

Cloud Run MCP versions before 1.11.0 are exposed to bucket squatting, where an attacker can take over a storage bucket the tool expects to exist. The sources say an attacker can then intercept and read proprietary source code, execute arbitrary code, and exfiltrate data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Cloud Run MCP version against `1.11.0`
- Review which Cloud Storage buckets the Cloud Run MCP deployment references and confirm each one is owned by your project

## Fix

- Upgrade Cloud Run MCP to `1.11.0` or later

## Timeline

- 2026-10-26T16:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85297

## From the sources

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.



Users must upgrade to Cloud Run MCP version 1.11.0 or later.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_