CVE-2026-79696
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 10
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Amber
- CWE
- CWE-184
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- Google Cloud Agent Development Kit (ADK) for Python
Weakness type
Related vulnerabilities
- CVE-2026-85788 — Incomplete list of disallowed inputs in awslabs mysql-mcp-server
- CVE-2026-86199 — PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login
- CVE-2026-82536 — Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator
- CVE-2026-69624 — Active Directory Certificate Services (AD CS) Tampering Vulnerability
- CVE-2026-70334 — Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-33197 — BDS Module Bypass Secure Boot Advisory
- CVE-2026-85787 — An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server
- CVE-2026-77124 — Nexus Repository 3 - Script Execution Disable Setting Not Enforced