PT-2026-32287 · Google · Agent Development Kit

Yoshizawa · CVE-2026-4810 · Published 2026-04-13 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Name of the Vulnerable Software and Affected Versions Google Agent Development Kit versions 1.7.0 through 1.28.0 Google Agent Development Kit versions 2.0.0a1 through 2.0.0a1

Description Code Injection and Missing Authentication issues in Google Agent Development Kit (ADK) on Python (OSS), Cloud Run, and GKE allow an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance. Technical details indicate the issue may involve the '/builder/save' endpoint, which could allow saving and subsequently executing arbitrary scripts on the server.

Recommendations Update to version 1.28.1 and redeploy to production environments, including local instances of ADK Web. Update to version 2.0.0a2 and redeploy to production environments, including local instances of ADK Web.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-4810

GHSA-RG7C-G689-FR3X

PYSEC-2026-344

Affected Products

Agent Development Kit

References · 15

• https://osv.dev/vulnerability/PYSEC-2026-344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4810 · Security Note
• https://osv.dev/vulnerability/CVE-2026-4810 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rg7c-g689-fr3x · Vendor Advisory
• https://github.com/google/adk-python/blob/main/CHANGELOG.md#1274-2026-03-26 · Note
• https://github.com/google/adk-python · Note
• https://github.com/advisories/GHSA-rg7c-g689-fr3x · Note
• https://twitter.com/pulsepatchio/status/2044250691015688386 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043686092973523095 · Twitter Post
• https://twitter.com/0dayPublishing/status/2043621368890052620 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2044044752862277837 · Twitter Post
• https://twitter.com/CveFindCom/status/2043626005890220490 · Twitter Post
• https://twitter.com/CVEnew/status/2043733059263193458 · Twitter Post
• https://reddit.com/r/agentdevelopmentkit/comments/1snmrc7/any_information_about_cve20264810_adkpython · Reddit Post
• https://pypi.org/project/google-adk · Note