CVE-2026-79696CWE-184

CVE-2026-79696

published September 9, 2026

CVSS
10.0
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.

The record
Technical detail
CVSS
10.0 · NONE
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Amber
EPSS
0.00740 · 54.1th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-09-09T13:17Z
References (2)
https://github.com/google/adk-python/commit/a16f6da3314b8dcd9925884cd6fc7fc9ffdd570d · f45cbf4e-4146-4068-b7e1-655ffc2c548chttps://github.com/google/adk-python/releases/tag/v2.7.0 · f45cbf4e-4146-4068-b7e1-655ffc2c548c
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 09 SEP 08:16Z
    Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
    cvelistv5