by Kastro
Paper/Archive/CVE-2026-79696

CVE-2026-79696

Google Cloud Agent Development Kit (ADK) for Python — Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist

EPSS 0.7%CVSS 10.0
critical.is priorityof 100
41
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 54.6.546 × 2010.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.

Affected

ProductAffectedFixed inSource
Agent Development Kit (ADK) for Python2.0.0 – < 2.7.02.7.0CNA

Scores by source

GoogleCloud (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Amber
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/google/adk-python/releases/tag/v2.7.0refgithub.com/google/adk-python/commit/a16f6da3314b8dcd9925884cd6fc7fc9ffdd570d