CVE-2026-79696
Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
- State
- Published
- Severity
- 10.0 Critical
- Published
- Sep 9, 2026
- Updated
- Sep 9, 2026
- Reserved
- Aug 25, 2026
Description
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 10.0 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Amber | GoogleCloud |
Weaknesses
- CWE-184 Incomplete List of Disallowed Inputs
Affected Products
| Product | Versions |
|---|---|
Agent Development Kit (ADK) for PythonGoogle Cloud |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.