CVE-2026-4810

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-4810
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4810.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-4810
Aliases
Published
2026-04-13T09:16:08.883Z
Modified
2026-07-15T06:01:36.635308Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber CVSS Calculator
Summary
[none]
Details

A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance.

This vulnerability was patched in versions 1.28.1 and 2.0.0a2.

Customers need to redeploy the upgraded ADK to their production environments. In addition, if they are running ADK Web locally, they also need to upgrade their local instance.

References

Affected packages

Git / github.com/google/adk-python

Affected ranges

Type
GIT
Repo
https://github.com/google/adk-python
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0d48362f2e5410f0f39fab8b38c2164d4293abc1
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.28.1"
        }
    ],
    "source": "DESCRIPTION"
}

Affected versions

v.*
v.1.9.0
v0.*
v0.1.0
v0.2.0
v0.3.0
v0.4.0
v0.5.0
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.14.1
v1.15.0
v1.15.1
v1.16.0
v1.17.0
v1.18.0
v1.19.0
v1.2.0
v1.2.1
v1.20.0
v1.21.0
v1.22.0
v1.22.1
v1.23.0
v1.24.0
v1.24.1
v1.25.0
v1.27.2
v1.28.0
v1.3.0
v1.4.1
v1.4.2
v1.5.0
v1.6.1
v1.7.0
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4810.json"