Google's Cloud Run MCP server could send your source code to a storage bucket an attacker set up first
On October 26, 2026, Google published CVE-2026-85297 for Cloud Run MCP before 1.11.0, the MCP server that lets AI assistants deploy apps to Cloud Run. The record, titled "Bucket Squatting in Cloud Run MCP leads to Service Account Takeover", says an attacker could intercept and access source code, execute arbitrary code, and exfiltrate data. Google scores it CVSS 4.0 7.7 High. The fix is in version 1.11.0, published to npm on September 28, 2026.
What was reported
CVE-2026-85297 was published October 26, 2026 by Google Cloud. It covers Cloud Run MCP before 1.11.0, Google's MCP server that lets AI agents and AI coding tools deploy apps to Cloud Run. Its README sets it up with npx -y @google-cloud/cloud-run-mcp. The record is titled "Bucket Squatting in Cloud Run MCP leads to Service Account Takeover" and says the flaw "allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data." It names CWE-340, generation of predictable numbers or identifiers, and Google scores it CVSS 4.0 7.7 High. NVD carries the same description.
The record does not list the steps of the attack. The 1.11.0 release notes include a change titled "fix: check bucket ownership", which makes the server confirm that an existing Cloud Storage bucket belongs to the user's own Google Cloud project before it uploads source code there. If the bucket belongs to another project, the fixed server uses a new bucket with a random suffix instead.
Version 1.11.0 was published to npm on September 28, 2026, four weeks before the CVE record, and the record says users must upgrade to 1.11.0 or later. The same server also ships as a Gemini CLI extension.
How to prevent it
Make sure the Cloud Run MCP server your assistant uses is version 1.11.0 or later. For the npx setup, replace the package argument with @google-cloud/cloud-run-mcp@1.11.0, then restart the assistant. For Docker, remote servers, or the Gemini CLI extension, verify the running server's version separately.
Sources
Related
Incidents on the same topics
- A crafted URL could run PowerShell on Windows through the open package, and MCP Inspector and OpenCode were affected
- Better Auth accepted an OAuth sign-in state as a Magic Link token, so knowing a user's email was enough to sign in as them
- One compressed request can crash a Node.js app that uses body-parser with default options
- @sentry/nextjs tunnelRoute skipped Next.js middleware for more paths than it forwards to Sentry
Guides for the same stack
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.