GO WITH THE FLOW: TAKING A SHADOW DEPENDENCY IN GCP DATAFLOW CROSS TENANT

Summary from the TLDR Data newsletter

Researchers uncovered a cross-tenant GCP Dataflow flaw where predictable default staging bucket names could let an attacker hijack staged artifacts and reach remote code execution on workers. Google has fixed the issue. Key takeaway: cloud pipelines should verify artifact ownership and integrity instead of trusting default infrastructure names or first-run setup paths.