CVE-2026-85297

UNKNOWN 0.0

Bucket Squatting in Cloud Run MCP leads to Service Account Takeover

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later.

CWE	CWE-340
Vendor	google cloud
Product	cloud run mcp
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for google cloud cloud run mcp

Be the first to know when new unknown vulnerabilities affecting google cloud cloud run mcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Google Cloud / Cloud Run MCP

0 < 1.11.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/GoogleCloudPlatform/cloud-run-mcp/releases/tag/v1.11.0

Credits

🔍 lambdasawa (Tsubasa Irisawa)