Skip to content

Google Cloud Storage

3,134 indexed

Google Cloud Storage exposures usually come from an IAM binding granting the `allUsers` or `allAuthenticatedUsers` principal `Storage Object Viewer` or `Storage Legacy Bucket Reader`. The bucket then accepts unauthenticated `GET ?list` requests.

Google Cloud Storage exposure data

3,134
Total tracked
3,134
Currently open
2026-08-12: 3,2992026-09-05: 3,134

Aggregate figures only. See the full open-buckets data across all providers.

Common misconfiguration class

GCS does not enforce Public-Access-Prevention by default. Buckets created before 2021 frequently kept legacy ACLs. The newer Uniform-Bucket-Level-Access mode removes ACL drift but isn't retroactive, so admins have to opt in per bucket.

Real-world impact

A public list on the GCS XML API (`GET storage.googleapis.com/<bucket>`) returns an XML manifest of every object. Even when the bucket is meant to serve a single static asset, the manifest leaks naming conventions, internal paths, and sometimes secrets in filenames.

Remediation

  • Switch the bucket to Uniform-Bucket-Level-Access, then remove the `allUsers` IAM binding.
  • Enable Public-Access-Prevention at the org or project level so re-creation of the binding fails.
  • Use signed URLs for time-limited public sharing instead of permanent public-read grants.

URL patterns

Google Cloud Storage buckets typically resolve under hostnames like:

  • storage.googleapis.com/example-bucket/
  • example-bucket.storage.googleapis.com

Check a specific Google Cloud Storage URL

Paste any Google Cloud Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.

Open the Viewer

Own a listed Google Cloud Storage bucket?

If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.

Submit takedown request