CVE-2026-85297

high

Description

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later.

References

https://github.com/GoogleCloudPlatform/cloud-run-mcp/releases/tag/v1.11.0

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109906

Details

Source: Mitre, NVD

Published: 2026-10-26

Updated: 2026-11-02

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 7.7

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Severity: High

EPSS

EPSS: 0.00314