CVE-2026-79696

Published Sep 9, 2026

Last updated 19 hours ago

CVSS critical 10.0
Cloud

Overview

Description
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
Source
f45cbf4e-4146-4068-b7e1-655ffc2c548c
NVD status
Awaiting Analysis

Risk scores

CVSS 4.0

Type
Secondary
Base score
10
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Severity
CRITICAL

Weaknesses

f45cbf4e-4146-4068-b7e1-655ffc2c548c
CWE-184

Social media

Hype score
Not currently trending

Related CVEs

  1. PaperCut NG/MF Missing Authentication for Critical Function Vulnerability•CVE-2026-81578
  2. Gitea Code Injection Vulnerability•CVE-2026-60004
  3. Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.•CVE-2026-66803
  4. JetBrains TeamCity Deserialization of Untrusted Data Vulnerability•CVE-2026-63077
  5. In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.•CVE-2026-66138

References

Sources include official advisories and independent security research.