Critical · 10.0 CVE-2026-79696 EUVD-2026-74768GHSA-q9cv-5mjc-7cjc

Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist

Published Sep 9, 2026 · Updated Sep 9, 2026 · Assigned by GoogleCloud

Vendor: Google Cloud Product: Agent Development Kit (ADK) for Python

Description

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.

Affected products

Vendor	Product	Affected	Fixed
Google Cloud	Agent Development Kit (ADK) for Python	2.0.0 – < 2.7.0	2.7.0

References

https://github.com/google/adk-python/releases/tag/v2.7.0
https://github.com/google/adk-python/commit/a16f6da3314b8dcd9925884cd6fc7fc9ffdd570d