Critical Vertex AI SDK Flaw Enabled Cross-Tenant RCE via Model Upload Hijacking

Palo Alto Networks Unit 42 disclosed a critical vulnerability in the Google Cloud Vertex AI SDK for Python that allowed attackers to hijack model uploads and achieve cross-tenant remote code execution in Vertex AI serving infrastructure. The issue affected google-cloud-aiplatform versions 1.139.0 and 1.140.0 and was caused by a predictable default staging bucket name and missing ownership verification during the SDK’s staging process. With only their own Google Cloud project and a victim’s project ID, an attacker could pre-create the expected bucket, intercept uploaded model artifacts, and swap in a malicious file during an approximately 2.5-second race window.

The attack abused Python pickle/joblib deserialization so that malicious code ran when the victim later deployed the poisoned model. Unit 42 said the technique could expose service account credentials from the serving environment and provide access to tenant-project resources including other model artifacts, BigQuery metadata, and Cloud Logging data. Google accepted the report and released fixes in versions 1.144.0 and 1.148.0; defenders are advised to upgrade to 1.148.0 or later and explicitly configure a staging bucket where appropriate.