CVE-2026-19485 Overview
CVE-2026-19485 is a predictable resource name vulnerability affecting BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce. The flaw allows an attacker who knows a victim's Google Cloud project number to obtain read and write access to staged data and error logs. Access is achieved through predictable Cloud Storage bucket names used during the import staging process. The issue is classified under [CWE-330: Use of Insufficiently Random Values]. Google patched the vulnerability server-side, and no customer action is required.
Critical Impact
An attacker with a valid Google Cloud identity and knowledge of a victim's project number can read and write staged commerce data and error logs, enabling data theft and potential model tampering.
Affected Products
- Google Cloud Vertex AI Search for Commerce (versions prior to 2026-04-27)
- BigQuery Import Staging component on Google Cloud Platform
- Cloud Storage buckets provisioned by the import staging workflow
Discovery Timeline
- 2026-08-26 - CVE-2026-19485 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-19485
Vulnerability Analysis
Vertex AI Search for Commerce ingests product catalog and user event data from BigQuery through an intermediate staging layer. The staging layer provisions Cloud Storage buckets that hold serialized records and error logs during the import job. These buckets used a naming scheme derived from the customer's project number, which is not a secret value.
An attacker authenticated to Google Cloud with any project of their own can enumerate or guess these bucket names once they learn a target project number. Project numbers appear in shared logs, IAM bindings, service account emails, and support communications, so treating them as confidential is not viable. The predictable naming pattern converts a low-value identifier into an access token for staged data.
Read access exposes product catalogs, pricing data, and user event streams processed by the Search for Commerce pipeline. Write access enables poisoning of import jobs, injection of forged records into the retrieval index, and tampering with error log contents used for debugging.
Root Cause
The root cause is deterministic resource naming without an unpredictable component such as a random suffix or per-tenant secret. [CWE-330] applies because the bucket identifier lacks entropy sufficient to prevent enumeration by any authenticated Google Cloud principal.
Attack Vector
Exploitation requires network access to the Google Cloud API surface and a low-privilege authenticated identity. The attacker constructs the predictable bucket name from the target project number and issues standard Cloud Storage read or write operations. No interaction with the victim is required. See the Palo Alto Networks Unit 42 analysis for a detailed walkthrough of the attack path against Vertex AI staging resources.
Detection Methods for CVE-2026-19485
Indicators of Compromise
- Cloud Storage objects.get, objects.list, or objects.create calls against Vertex AI Search for Commerce staging buckets from principals outside the project's expected service accounts.
- Unexpected write operations targeting bucket names derived from the project number pattern used by BigQuery Import Staging.
- Anomalous entries or gaps in Vertex AI Search for Commerce import error logs that do not correspond to submitted import jobs.
Detection Strategies
- Review Cloud Audit Logs for storage.googleapis.com data access events referencing staging buckets, filtering on principalEmail values external to the project.
- Correlate BigQuery import job identifiers with Cloud Storage access events to identify staging bucket access outside the job lifecycle window.
- Alert on IAM principals from unrelated projects accessing resources whose names contain the project number of a monitored tenant.
Monitoring Recommendations
- Enable Cloud Storage Data Access audit logs across projects running Vertex AI Search for Commerce workloads.
- Feed Google Cloud audit logs into a centralized analytics platform to hunt for cross-tenant access patterns and staging-bucket anomalies.
- Track integrity of imported catalogs by hashing source BigQuery snapshots and comparing against post-import records.
How to Mitigate CVE-2026-19485
Immediate Actions Required
- Confirm the fix by reviewing Google Cloud release notes for Vertex AI Search for Commerce dated on or after 2026-04-27; no customer patch deployment is required.
- Audit historical Cloud Audit Logs for staging bucket access predating the fix to identify any prior unauthorized reads or writes.
- Validate the integrity of product catalogs and user event data imported before the patch date and reimport from trusted sources where tampering is suspected.
Patch Information
Google applied the fix to Vertex AI Search for Commerce infrastructure. The advisory states the vulnerability was patched server-side and no customer action is needed. Confirm your workload is running against current Google-managed endpoints and review the Palo Alto Networks Unit 42 write-up for background on the class of issue.
Workarounds
- Treat Google Cloud project numbers as sensitive operational metadata and restrict their exposure in external documentation and support tickets.
- Apply least-privilege IAM on Cloud Storage and BigQuery resources so that only required service accounts can read or write staging data.
- Enable VPC Service Controls around Vertex AI and Cloud Storage to limit access to trusted network perimeters.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
