What is GHSA-cg86-fr78-hv98?

GHSA-cg86-fr78-hv98 is a security advisory published by GitHub Security Advisories with High severity. Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows...

Which CVE IDs does GHSA-cg86-fr78-hv98 cover?

GHSA-cg86-fr78-hv98 covers the following CVE IDs: CVE-2026-85297. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-cg86-fr78-hv98High

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows...

Vendor

GitHub Security Advisories

Published

October 26, 2026

Last Modified

October 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-85297 →

📋 Description

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.

Users must upgrade to Cloud Run MCP version 1.11.0 or later.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-85297
https://github.com/GoogleCloudPlatform/cloud-run-mcp/releases/tag/v1.11.0
https://github.com/advisories/GHSA-cg86-fr78-hv98