Google ADK-Python - Unauthenticated Builder Endpoint

Google Agent Development Kit ADK 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2 on Python OSS, Cloud Run, and GKE contains a code injection and missing authentication vulnerability, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no authentication...

CVE-2026-4810

creationtimestamp| type| source ---|---|--- 2026-04-13 11:12:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjeqcapg6m2r 2026-04-13 11:15:29+00:00| published-proof-of-concept| Telegram/fSDxF1W-oA5l6tgQa9ar4bEO6UgKzKht9blWdgmI3wf0 2026-04-14 17:25:07+00:00| seen|...

CVE-2026-4810 Remote Code Execution in Google Agent Development Kit (ADK)

A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit ADK versions 1.7.0 and 2.0.0a1 through 1.28.1 and 2.0.0a2 on Python OSS, Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance. This...