Login Request a demo
High severity · published Sep 15, 2026
CVE-2026-19407
GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK
7.7
CVSS
0.7%
EPSS
No
On KEV
Description
Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Gemini Enterprise Agent Platform SDK for Python · Google Cloud
1.16.0 before 1.165.1 · source: vendor
Affected product
GE
Gemini Enterprise Agent Platform SDK for Python
Google Cloud
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19407
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19407
docs.cloud.google.com
https://docs.cloud.google.com/gemini-enterprise-agent-platform/release-notes#March_31_2026