Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE

A vulnerability in the Google Cloud Vertex AI Python SDK (versions 1.139.0 - 1.140.0) allowed attackers to hijack model uploads and execute remote code execution (RCE) within a target's Vertex AI serving infrastructure. This was achieved through ‘bucket squatting,’ where an attacker created a bucket with a predictable name based on the victim’s project ID, allowing them to replace the victim’s model with a malicious payload. The issue has been addressed in version 1.148.0, and developers are advised to upgrade.