CVEvulnerability

CVE-2026-79696

10.0 CRITICAL Published 2026-09-09 Modified 2026-09-09 Official page ↗

Status: Awaiting Analysis
Published: 2026-09-09
Last modified: 2026-09-09
Assigner: f45cbf4e-4146-4068-b7e1-655ffc2c548c
CVSS 4.0 (f45cbf4e-4146-4068-b7e1-655ffc2c548c): 10.0 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Weaknesses: CWE-184

Description

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.

Weakness · CWE (1)

CWE-184 Incomplete List of Disallowed Inputs weakness

References

https://github.com/google/adk-python/commit/a16f6da3314b8dcd9925884cd6fc7fc9ffdd570d github.com
https://github.com/google/adk-python/releases/tag/v2.7.0 github.com

CVE-2026-79696

Description

Related

Weakness · CWE (1)

References