Threat · curated 3 Jul 2026
Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE
First reported · updated · 2 reports paloaltonetworks.com
Coverage timeline
Why it matters
CVE-2026-0257 shows how the managed AI/ML model-upload pipeline itself can be weaponized for cross-tenant RCE via unsafe pickle deserialization, exposing a supply-chain attack surface defenders using Vertex AI must patch.
Palo Alto Unit 42 (Ori Hadad) disclosed CVE-2026-0257, a flaw in Google's Vertex AI Python SDK (python-aiplatform) where model uploads relied on an attacker-predictable Google Cloud Storage bucket, enabling 'bucket squatting.' An attacker could pre-register the expected bucket and substitute a malicious pickle/joblib model artifact, achieving cross-tenant remote code execution when the poisoned model was deserialized. Google fixed the issue in SDK releases v1.148.0/v1.148.1.