PT-2026-6799 · Unknown+1 · Agentspace+2

Omer Amiad · Published 2026-02-06 · Updated 2026-04-20 · CVE-2026-1727

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

Name of the Vulnerable Software and Affected Versions Agentspace versions prior to December 12th, 2025

Description The Agentspace service had a flaw that led to the exposure of sensitive information. This was due to the use of predictable Google Cloud Storage bucket names for error logs and temporary staging during data imports from Google Cloud Storage and Cloud SQL. An attacker could exploit this by performing "bucket squatting," creating these buckets before legitimate users, potentially gaining access to data.

Recommendations Update to a version released after December 12th, 2025.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-1727

Affected Products

Agentspace

Cloud Sql

Google Cloud Storage

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-1727 · Security Note
• https://twitter.com/0dayPublishing/status/2019892988692795434 · Twitter Post
• https://twitter.com/CVEnew/status/2019898573505155476 · Twitter Post
• https://twitter.com/offseq/status/2020112864623628746 · Twitter Post
• https://t.me/cveNotify/151430 · Telegram Post
• https://twitter.com/omer_asfu/status/2046307225581600838 · Twitter Post
• https://docs.cloud.google.com/gemini/enterprise/docs/release-notes#February_06_2026 · Note