Google Cloud Agent Development Kit (ADK) vulnerabilities

Latest Google Cloud Agent Development Kit (ADK) CVEs

Newest publication first

1. CVE-2026-79707 Arbitrary File Read in Google Agent Development Kit (ADK)

   Published 2026-09-04

   High·CVSS 8.7 EPSS 0.67%

   A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query parameter.

2. CVE-2026-4810 Remote Code Execution in Google Agent Development Kit (ADK)

   Published 2026-04-13

   Critical·CVSS 9.3 EPSS 2.2%

   A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.