Advisoriesby IbisGoogle CloudCVE-2026-85297
Google Cloud Cloud Run MCP: code execution
Fix: upgrade to 1.11.0 or later
Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.
Users must upgrade to Cloud Run MCP version 1.11.0 or later.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Cloud Run MCP Product | < 1.11.0 | 1.11.0 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-340