What’s Vulnerable › Vulnerabilities
CVE-2026-1727: Information Disclosure via Bucket Squatting in Google Cloud Agentspace.
- Severity: critical (CVSS 9.1 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-06 · updated 2026-06-17
- Weakness: CWE-200
Description
The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage bucket names. These names were utilized for error logs and temporary staging during data imports from GCS and Cloud SQL. This predictability allowed an attacker to engage in "bucket squatting" by establishing these buckets before a victim's initial use. All versions after December 12th, 2025 have been updated to protect from this vulnerability. No user action is required for this.
Affected products
- Google Cloud Gemini Enterprise (formerly Agentspace): before 12/12/2025 — fixed in 12/12/2025
How to fix
Upgrade to a fixed version: Google Cloud Gemini Enterprise (formerly Agentspace) 12/12/2025. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-1727 or the next vulnerability affects your stack