Google Security Incident

A vulnerability in Google Cloud's Vertex AI platform allowed for the misuse of the Per-Project, Per-Product Service Agent (P4SA) due to excessive default permissions. This flaw enabled attackers to exfiltrate service agent credentials, gaining unauthorized read access to customer Google Cloud Storage data and proprietary container images from Google's internal Artifact Registry.

What Happened

A vulnerability in Google Cloud's Vertex AI platform allowed for the misuse of the Per-Project, Per-Product Service Agent (P4SA) due to excessive default permissions. This flaw enabled attackers to exfiltrate service agent credentials, gaining unauthorized read access to customer Google Cloud Storage data and proprietary container images from Google's internal Artifact Registry.

Why This Matters

Publisher reporting describes a security event affecting p4sa. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

Confirm whether p4sa is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.

Exposure

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

Timeline

• Incident first seen
  Mar 31, 2026 05:30

  BugSkan first recorded this incident.

• Vertex AI Vulnerability Exposes Google Cloud Data and Private Artifacts - The Hacker News
  Mar 31, 2026 05:30

  thehackernews.com · Vulnerability

Sources

Related Incidents

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match