CVE-2026-2244CWE-200

Sensitive Data Exposure in Google Cloud Vertex AI Workbench

High · published February 26, 2026

CVSS v4.0
8.4
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

A vulnerability in Google Cloud Vertex AI Workbench from 7/21/2025 to 01/30/2026 allows an attacker to exfiltrate valid Google Cloud access tokens of other users via abuse of a built-in startup script.

All instances after January 30th, 2026 have been patched to protect from this vulnerability. No user action is required for this.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Clear
EPSS
0.00240 · 14.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-02-26T14:14Z
EPSS history
Timeline
  • 26 FEB 14:14Z
    Sensitive Data Exposure in Google Cloud Vertex AI Workbench
    cvelistv5