Executive Summary
Palo Alto Networks Unit 42 discovered a critical vulnerability in the Google Cloud Vertex AI SDK for Python (google-cloud-aiplatform) that enables remote code execution (RCE) and cross-tenant data exfiltration. The vulnerability, dubbed 'Pickle in the Middle', stems from a lack of bucket ownership verification in the SDK's staging logic combined with predictable default bucket names.
By preemptively creating a GCS bucket matching a target's deterministic staging name (bucket squatting), an attacker can intercept victim model artifacts. Exploiting a narrow race condition, the attacker replaces legitimate model files with malicious payloads that leverage Python's pickle deserialization mechanism. When the victim deploys the poisoned model, the attacker's code executes within the Google-managed tenant project, providing access to broad cloud-platform scoped OAuth tokens.
This flaw highlights a significant risk in AI/ML lifecycles where developer tools interact with cloud storage. Google has released patches in SDK version 1.148.0 to implement bucket ownership checks and randomized bucket naming. Organizations using Vertex AI should ensure their SDKs are updated and consider explicitly defining private staging buckets to mitigate similar supply chain risks.