CVE-2026-107858

A flaw was found in the Google Agent Development Kit ADK for Java development web server, which can lead to unauthorized control of locally running agents and information disclosure. The server lacks authentication and does not restrict incoming WebSocket and cross-origin HTTP requests to trusted...

SUSE CVE-2026-115522

Exposure of Resource to Wrong Sphere CWE-668 in FileArtifactService in Google Agent Development Kit ADK for Python google-adk versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application wh...

CVE-2026-115522

A flaw was found in the FileArtifactService component of Google Agent Development Kit ADK. The service fails to isolate stored files by application name when constructing directory paths on disk. This issue allows a user in one application to access, overwrite, or delete stored files belonging to...

CVE-2026-115522

Exposure of Resource to Wrong Sphere CWE-668 in FileArtifactService in Google Agent Development Kit ADK for Python google-adk versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application wh...

EUVD-2026-111589

Exposure of Resource to Wrong Sphere CWE-668 in FileArtifactService in Google Agent Development Kit ADK for Python google-adk versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application wh...

CVE-2026-115522 Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python

Exposure of Resource to Wrong Sphere CWE-668 in FileArtifactService in Google Agent Development Kit ADK for Python google-adk versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application wh...

CVE-2026-115522

The Google Agent Development Kit (ADK) for Python (google-adk) contains a Cross-Application Artifact Namespace Isolation vulnerability (CWE-668) in the FileArtifactService component. This affects versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 . The root cause is that the service accepts a...

CVE-2026-115522 Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python

Exposure of Resource to Wrong Sphere CWE-668 in FileArtifactService in Google Agent Development Kit ADK for Python google-adk versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application wh...

PT-2026-127810

Exposure of Resource to Wrong Sphere CWE-668 in FileArtifactService in Google Agent Development Kit ADK for Python google-adk versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application wh...

Google Agent Development Kit permission and access control issue vulnerability

Versions prior to 1.39.1 of the Google Agent Development Kit contain a permission and access control vulnerability. Versions 1.19.0 and 2.0.0a1 prior to 2.7.0 are affected; this issue arises because FileArtifactService accepts appname in its public API methods but omits it when constructing disk...

CVE-2026-115522: Google Agent Development Kit (ADK) for Python: Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python…

Exposure of Resource to Wrong Sphere CWE-668 in FileArtifactService in Google Agent Development Kit ADK for Python google-adk versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application wh...

CVE-2026-107858

Missing Origin Validation in WebSockets CWE-1385 and Permissive Cross-domain Policy with Untrusted Domains CWE-942 in the development web server ADK Web in Google Agent Development Kit ADK for Java com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plug...

CVE-2026-107858

The Google Agent Development Kit (ADK) for Java development web server (ADK Web) is vulnerable to Cross-Site WebSocket Hijacking (CWE-1385) and Permissive CORS (CWE-942). The issue stems from missing origin validation in the /run_live WebSocket endpoint and a default Access-Control-Allow-Origin: ...

EUVD-2026-108585

Missing Origin Validation in WebSockets CWE-1385 and Permissive Cross-domain Policy with Untrusted Domains CWE-942 in the development web server ADK Web in Google Agent Development Kit ADK for Java com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plug...

CVE-2026-107858 Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

Missing Origin Validation in WebSockets CWE-1385 and Permissive Cross-domain Policy with Untrusted Domains CWE-942 in the development web server ADK Web in Google Agent Development Kit ADK for Java com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plug...

CVE-2026-107858 Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

Missing Origin Validation in WebSockets CWE-1385 and Permissive Cross-domain Policy with Untrusted Domains CWE-942 in the development web server ADK Web in Google Agent Development Kit ADK for Java com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plug...

CVE-2026-107858 Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

Missing Origin Validation in WebSockets CWE-1385 and Permissive Cross-domain Policy with Untrusted Domains CWE-942 in the development web server ADK Web in Google Agent Development Kit ADK for Java com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plug...

CVE-2026-107858

Missing Origin Validation in WebSockets CWE-1385 and Permissive Cross-domain Policy with Untrusted Domains CWE-942 in the development web server ADK Web in Google Agent Development Kit ADK for Java com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plug...

Google Agent Development Kit for Java input validation error vulnerability

A security vulnerability exists in Google Agent Development Kit for Java versions 0.1.0 through 1.13.0 and 0.3.0 through 1.13.0. This vulnerability stems from a lack of source validation in the WebSocket handling used by ADK Web, coupled with overly permissive cross-origin policies. The /runlive...

PT-2026-121758

Missing Origin Validation in WebSockets CWE-1385 and Permissive Cross-domain Policy with Untrusted Domains CWE-942 in the development web server ADK Web in Google Agent Development Kit ADK for Java com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plug...