CVE-2026-85297

The record

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later.

Affected packages

Related vulnerabilities

• CVE-2026-118527 Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and… CWE-340
• CVE-2026-79980 The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier… CWE-340
• CVE-2026-46347 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-340
• CVE-2026-46346 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-340
• CVE-2026-64964 ATutor generates predictable email confirmation tokens due to the use of insufficiently… CWE-340
• CVE-2026-13577 Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG… CWE-340
• CVE-2026-47085 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. CWE-340
• CVE-2026-56016 CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from… CWE-340