Vulnerability · Published Feb 6, 2026 · Assigned by GoogleCloud
CVE-2026-1727Information Disclosure via Bucket Squatting in Google Cloud Agentspace.
Critical 9.1
In plain English
A critical-severity information exposure in Gemini Enterprise (formerly Agentspace) from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage bucket names. These names were utilized for error logs and temporary staging during data imports from GCS and Cloud SQL. This predictability allowed an attacker to engage in "bucket squatting" by establishing these buckets before a victim's initial use. All versions after December 12th, 2025 have been updated to protect from this vulnerability. No user action is required for this.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google Cloud | Gemini Enterprise (formerly Agentspace) | 0 – before 12/12/2025 |
Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L/U:Clear