CVE-2026-1727

The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage bucket names. These names were utilized for error logs and temporary staging during data imports from GCS and Cloud SQL. This predictability allowed an attacker to engage in "bucket squatting" by establishing these buckets before a victim's initial use. All versions after December 12th, 2025 have been updated to protect from this vulnerability. No user action is required for this.

CVSS

No CVSS.

References

Link	Resource
https://docs.cloud.google.com/gemini/enterprise/docs/release-notes#February_06_2026

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) El servicio Agentspace se vio afectado por una vulnerabilidad que expuso información sensible debido al uso de nombres predecibles para los buckets de Google Cloud Storage. Estos nombres se utilizaron para registros de errores y preparación temporal durante las importaciones de datos desde GCS y Cloud SQL. Esta predictibilidad permitió a un atacante participar en 'bucket squatting' al establecer estos buckets antes del uso inicial de una víctima. Todas las versiones posteriores al 12 de diciembre de 2025 se han actualizado para protegerse de esta vulnerabilidad. No se requiere ninguna acción del usuario para esto.

06 Feb 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-06 22:16

Updated : 2026-06-17 10:16

NVD link : CVE-2026-1727

Mitre link : CVE-2026-1727

CVE.ORG link : CVE-2026-1727

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-1727", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1727", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T15:04:36.280490Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "CLEAR", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "affectedData": [{"vendor": "Google Cloud", "product": "Gemini Enterprise (formerly Agentspace)", "versions": [{"status": "affected", "version": "0", "lessThan": "12/12/2025", "versionType": "date"}], "defaultStatus": "unaffected"}]}], "published": "2026-02-06T22:16:10.860", "references": [{"url": "https://docs.cloud.google.com/gemini/enterprise/docs/release-notes#February_06_2026", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage bucket names. These names were utilized for error logs and temporary staging during data imports from GCS and Cloud SQL. This predictability allowed an attacker to engage in \"bucket squatting\" by establishing these buckets before a victim's initial use.\n\nAll versions after December 12th, 2025 have been updated to protect from this vulnerability. No user action is required for this."}, {"lang": "es", "value": "El servicio Agentspace se vio afectado por una vulnerabilidad que expuso informaci\u00f3n sensible debido al uso de nombres predecibles para los buckets de Google Cloud Storage. Estos nombres se utilizaron para registros de errores y preparaci\u00f3n temporal durante las importaciones de datos desde GCS y Cloud SQL. Esta predictibilidad permiti\u00f3 a un atacante participar en 'bucket squatting' al establecer estos buckets antes del uso inicial de una v\u00edctima.\n\nTodas las versiones posteriores al 12 de diciembre de 2025 se han actualizado para protegerse de esta vulnerabilidad. No se requiere ninguna acci\u00f3n del usuario para esto."}], "lastModified": "2026-06-17T10:16:24.490", "sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}