A flaw in Google Cloud Vertex AI Workbench allowed an attacker to steal valid Google Cloud access tokens belonging to other users by exploiting a built‑in startup script. The vulnerability could lead to unauthorized access to Google Cloud resources, compromising confidentiality and potentially granting the attacker full privilege of the compromised user account. The weakness is classified as sensitive data exposure (CWE‑200).

The issue affected Vertex AI Workbench instances that were active between July 21, 2025 and January 30, 2026. All workbench deployments created after January 30, 2026 have been patched automatically. No explicit version numbers are listed, but any instance launched during the quoted period is considered vulnerable.

The CVSS score of 8.4 indicates high severity, yet the EPSS score of less than 1% shows a very low likelihood of real‑world exploitation at the time of analysis. The vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to persuade or compromise a user to supply a malicious startup script or otherwise induce the script execution; the exploit requires language capabilities to read the workbench environment’s credentials. Given the low EPSS and lack of publicly known active exploits, the immediate risk to an organization that maintains the affected period is limited, but the potential impact remains significant if the flaw is leveraged.