Agent Development Kit (ADK) vulnerabilities

2 known vulnerabilities in Agent Development Kit (ADK) from Google Cloud. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  Agent Development Kit (ADK): Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-79707Sep 4, 2026Google Cloud

  A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query parameter.

• 9.3 Critical severity

  Agent Development Kit (ADK): Missing Authentication for Critical Functionality

  CVE-2026-4810Apr 13, 2026Google CloudEPSS 2.2%

  A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on