Google patches critical bucket-squatting flaw in Gemini Enterprise — no action needed, but here's what happened
CVE-2026-1727 let attackers intercept Gemini Enterprise data via predictable Cloud Storage bucket names. Google patched it automatically in December 2025.
Google has quietly patched a critical vulnerability in Gemini Enterprise, its premium AI platform for large organisations. The fix was deployed server-side on December 12, 2025, and publicly disclosed on February 6, 2026. You do not need to do anything. But given this is a CVSS 9.1 Critical-rated flaw that sat in the data ingestion pipeline of an enterprise AI product, it’s worth understanding what actually happened.
What the vulnerability was
CVE-2026-1727, nicknamed “GeminiSquat” by the researchers who discovered it, is a bucket-squatting vulnerability. To understand why that matters, a quick primer.
Google Cloud Storage uses a globally shared namespace for bucket names. Every bucket name across every organisation worldwide must be unique. The first account to register a name gets it, full stop. There is no “this bucket belongs to Acme Corp” check at the naming level. If you can predict the name a service will use before it gets created, you can register it yourself and sit there waiting.
That is exactly what this flaw enabled. Gemini Enterprise (formerly called Agentspace) used predictable, deterministic names for the Cloud Storage buckets it created during data ingestion. These buckets were used for two things: error logs and temporary staging during imports from Cloud Storage and Cloud SQL. The naming pattern incorporated variables like data source type and GCP region, which are straightforward to guess, plus the victim organisation’s GCP project number, which can be enumerated through basic reconnaissance.
An attacker who worked out the formula could pre-register the bucket names for a target organisation. When Gemini Enterprise then tried to write error logs or stage import data, it would write to the attacker’s bucket instead of its own. The attacker could read that data, or write malicious data back into the pipeline.
No user interaction was required. The attack vector is network-accessible and the exploit can be performed by any authenticated GCP user who can create a storage bucket.
How serious is a 9.1?
CVSS 9.1 is Critical, sitting just below the maximum score of 10. The specific rating here reflects: network-accessible, low attack complexity, no privileges required, no user interaction needed, and high impact on both confidentiality and integrity.
High confidentiality impact means an attacker could read data flowing through the ingestion pipeline. High integrity impact means they could also tamper with that data before it reached Gemini Enterprise. For an AI product that exists specifically to ingest and reason over your organisation’s internal data, integrity compromise is particularly worth noting.
The vulnerability was discovered by Focal Security, who also identified two related bucket-squatting flaws in other GCP products during the same research effort: VertexSquat (CVE-2026-2473) in Vertex AI Experiments, and MountSquat. All three were reported to Google and patched before any known exploitation in the wild.
What Google fixed and how
The fix addresses the root cause: the naming scheme. By incorporating sufficient randomisation or customer-specific identifiers that cannot be predicted externally, the bucket names are no longer guessable in advance. The patch was deployed at the infrastructure level, which is why there is nothing for you to configure or update.
The Gemini Enterprise release notes confirm that all versions after December 12, 2025 are protected.
What this means for you
If your organisation uses Gemini Enterprise today, you are protected. Google handles the infrastructure, and this patch was applied server-side.
The caveat worth raising is the exposure window. The vulnerability existed in versions prior to December 12, 2025, and the public disclosure came nearly two months later. If your organisation was actively using Gemini Enterprise and ingesting data from Cloud SQL or Cloud Storage before that date, there is a theoretical window during which a pre-positioned attacker could have accessed error logs or staged import data.
Google and Focal Security have stated the vulnerability was not exploited in the wild before the patch, but “not known to have been exploited” and “definitely was not exploited” are different things. If you have compliance obligations or internal security audit requirements, it is worth documenting this disclosure and, if warranted, reviewing data import activity logs from before December 12, 2025 for anything unusual.
A practical defensive note for the future
Focal Security’s research highlights something worth building into your GCP security posture regardless of this specific fix. VPC Service Controls create a security perimeter around your GCP project. If a managed GCP service were to attempt writing data to a bucket outside your perimeter, VPC Service Controls would block that connection. This would not have prevented the vulnerability from existing, but it would have prevented exploitation in a well-configured environment.
If you are running sensitive workloads on GCP managed services, particularly anything in the AI data ingestion space, VPC Service Controls are worth reviewing as a baseline control.
The bigger picture
This is the second predictable-bucket-name flaw to surface in GCP’s AI product portfolio in a short period, with CVE-2026-2473 in Vertex AI Experiments patched around the same time. The pattern here is not unique to Google. As cloud providers build more managed AI services that handle data on your behalf, the internal plumbing of those services creates attack surface that organisations cannot directly inspect or control. The tradeoff is real: managed services reduce operational complexity, but they also mean you are trusting the provider’s internal implementation details.
Google’s response here was reasonable. Focal Security reported responsibly, Google patched before public disclosure, and the fix required no action from customers. But the two-month gap between the patch and the public CVE disclosure is a reminder that your exposure window is not always visible to you in real time.
For now: no action required, exposure patched, and worth a note in your security log.