VulnSocial

CVE-2026-85297

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-340

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-28: 110-28
Referenced assets1 URL
Full discourse1 post
  • Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs

    CVE-2026-85297 affects Google Cloud Run MCP. Predictable storage bucket names can let attackers intercept deployment artifacts and potentially inject malicious code into cloud workloads. Analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-10-26/TIER_2_CVE-2026-85297.md #CyberSecurity #CloudSecurity #SupplyChain

    0000020
    65 followersView on X

Explore more

Back to dashboard