Google Cloud Cloud Run MCP vulnerabilities

Latest Google Cloud Cloud Run MCP CVEs

Newest publication first

1. CVE-2026-85297 Bucket Squatting in Cloud Run MCP leads to Service Account Takeover

   Published 2026-10-26

   High·CVSS 7.7 EPSS 0.31%

   Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.