CVE-2026-2244: Google Cloud Vertex AI Information Disclosure

CVE-2026-2244 Overview

A vulnerability in Google Cloud Vertex AI Workbench allows an attacker to exfiltrate valid Google Cloud access tokens of other users via abuse of a built-in startup script. This information disclosure vulnerability affects Vertex AI Workbench instances created between July 21, 2025 and January 30, 2026.

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the startup script mechanism inadvertently exposes authentication credentials to unauthorized parties.

Critical Impact

Attackers can steal valid Google Cloud access tokens from other users, potentially gaining unauthorized access to cloud resources, data, and services associated with the compromised accounts.

Affected Products

• Google Cloud Vertex AI Workbench instances created between July 21, 2025 and January 30, 2026

Discovery Timeline

• February 26, 2026 - CVE CVE-2026-2244 published to NVD
• February 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2244

Vulnerability Analysis

This information disclosure vulnerability stems from improper handling of user credentials within the built-in startup script mechanism of Google Cloud Vertex AI Workbench. The startup script, which executes during instance initialization, contains a flaw that allows attackers to intercept or extract valid Google Cloud access tokens belonging to other users sharing the same environment.

The attack requires network access and low privileges, but does require some user interaction. Once exploited, an attacker gains access to authentication tokens that could provide unauthorized access to the victim's Google Cloud resources and services. The impact extends beyond the vulnerable component itself, potentially affecting confidentiality and integrity of connected systems throughout the Google Cloud environment.

Root Cause

The root cause of this vulnerability lies in the startup script's improper isolation of user credentials. The built-in startup script mechanism failed to adequately protect access tokens during the instance initialization process, allowing them to be exposed to other authenticated users who could abuse the script functionality to capture these credentials.

Attack Vector

The attack is executed over the network and requires the attacker to have low-level privileges on the Vertex AI Workbench platform. The attacker abuses the built-in startup script functionality to intercept or exfiltrate Google Cloud access tokens belonging to other users. While user interaction is required for exploitation, the attack can lead to significant downstream impact on confidentiality and integrity of connected cloud resources.

The vulnerability mechanism involves manipulating or observing the startup script execution to capture credentials that are temporarily exposed during the initialization workflow. For detailed technical information, refer to the Google Cloud Release Notes.

Detection Methods for CVE-2026-2244

Indicators of Compromise

• Unusual access patterns or API calls from Vertex AI Workbench instances to other Google Cloud services
• Unexpected startup script modifications or execution anomalies
• Authentication events from access tokens originating from unfamiliar IP addresses or geographic locations
• Audit logs showing token usage patterns inconsistent with legitimate user behavior

Detection Strategies

• Monitor Google Cloud audit logs for anomalous access token usage patterns across Vertex AI Workbench instances
• Implement alerting for startup script execution events that deviate from baseline behavior
• Review Cloud Identity and Access Management (IAM) logs for suspicious authentication events
• Enable and analyze VPC Flow Logs for unusual network traffic from Workbench instances

Monitoring Recommendations

• Configure Google Cloud Security Command Center to detect and alert on potential credential exfiltration attempts
• Implement Cloud Audit Logs retention and analysis for forensic investigation capabilities
• Set up real-time monitoring for access token creation and usage across the Google Cloud environment
• Deploy SentinelOne Singularity Cloud Security for comprehensive cloud workload protection and threat detection

How to Mitigate CVE-2026-2244

Immediate Actions Required

• Verify that all Vertex AI Workbench instances have been automatically patched (instances after January 30, 2026 are protected)
• Review audit logs for any suspicious activity on Workbench instances created between July 21, 2025 and January 30, 2026
• Rotate any access tokens that may have been exposed during the vulnerability window
• Review IAM permissions and access patterns for anomalies during the affected time period

Patch Information

Google has automatically remediated this vulnerability for all Vertex AI Workbench instances. All instances created after January 30, 2026 have been patched to protect from this vulnerability. No user action is required for remediation.

For additional details, consult the Google Cloud Release Notes.

Workarounds

• Rotate all Google Cloud access tokens that were active during the vulnerability window (July 21, 2025 to January 30, 2026)
• Implement the principle of least privilege for all Vertex AI Workbench users and service accounts
• Enable VPC Service Controls to limit potential data exfiltration paths
• Consider recreating any Workbench instances that were active during the vulnerable period to ensure clean state

# Rotate service account keys for affected projects
gcloud iam service-accounts keys list --iam-account=SERVICE_ACCOUNT_EMAIL
gcloud iam service-accounts keys delete KEY_ID --iam-account=SERVICE_ACCOUNT_EMAIL
gcloud iam service-accounts keys create new-key.json --iam-account=SERVICE_ACCOUNT_EMAIL