CVE-2026-79696
A code injection flaw exists in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 when pytest is installed. The vulnerability allows an unauthenticated attacker to run arbitrary code by replaying a crafted test session. It affects Python OSS, Cloud Run, and GKE environments that use ADK.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Google Cloud Agent Development Kit (ADK) for Python 2.0.0‑2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed.
Real-world impact
An attacker could execute any code on the affected system, potentially taking full control, exfiltrating data, or disrupting services.
Why this severity
The CVSS score of 10 reflects the vulnerability’s ability to compromise confidentiality, integrity, and availability with no authentication or user interaction required, making it a critical risk.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources