Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Google Cloud ADK for Python lets attackers run code

CVE-2026-79696 · published 1 month ago
Summary

Versions 2.0.0 through 2.6.0 of the Google Cloud Agent Development Kit for Python can let an unauthenticated attacker run any code if the library pytest is installed. This could let an attacker take control of applications running on Cloud Run, GKE or other Python environments. Upgrade to the latest ADK release (or remove pytest) as soon as possible to stop the risk.

What to do
  • Update google cloud agent development kit (adk) for python to version 2.7.0 or later.
Affected software
VendorProductAffected versions
google cloud agent development kit (adk) for python < 2.7.0
Original advisory text
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is instal...
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
References
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-184Incomplete List of Disallowed Inputs
Timeline
Published9 Sep 2026
Updated11 Oct 2026
First seen9 Sep 2026
Sources
CVE-2026-79696 · NVD
CVE-2026-79696 · MITRE
CVE-2026-79696 · OSV
Track software like this
Free during beta