Google Vertex AI SDK Flaw Allows Attackers to Hijack Model Uploads via Bucket Squatting

A critical flaw in the Google Cloud Vertex AI SDK for Python has been discovered that could allow an attacker with no prior access to a victim’s project to hijack machine learning model uploads and execute arbitrary code within Google’s serving infrastructure. The vulnerability, dubbed “Pickle in the Middle” by Palo Alto Networks Unit 42, was responsibly disclosed through Google’s bug bounty program and has since been patched.

The flaw resides in how the SDK selects a temporary Cloud Storage bucket for model uploads. When a user does not specify a bucket, the SDK generates a predictable name based on the project ID and region (e.g., project-vertex-staging-region). It checks if the bucket exists but does not verify ownership. Since bucket names are globally unique, an attacker can create the expected bucket in their own project. The victim’s SDK then uploads model files to the attacker’s bucket, where the attacker can replace the model with a malicious one. Many Python ML models use pickle or joblib, which can execute code upon loading. When Vertex AI loads the swapped model, the attacker’s code runs inside the serving container.

The attack requires speed: Unit 42 measured about 2.5 seconds between upload and Vertex AI reading the file. In their proof of concept, an attacker used a Cloud Function triggered after upload to replace the model in 1.4 seconds. The payload then stole an OAuth token from the serving container’s metadata server, which in their test environment could access other model artifacts, BigQuery metadata, access lists, tenant logs, GKE cluster names, and internal container image paths.

The attack works only if the victim’s default staging bucket does not already exist in that region and the developer leaves the staging_bucket parameter unset. Unit 42 reported the flaw on March 5, 2026, testing versions 1.139.0 and 1.140.0. Google shipped an initial fix in v1.144.0 on March 31, adding a random uuid4 to the bucket name, and completed the fix in v1.148.0 on April 15 with bucket ownership verification. Users are urged to update to version 1.148.0 or later and set an explicit staging_bucket. No CVE has been assigned as of publication.