Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-79707

Arbitrary File Read in Google Agent Development Kit (ADK)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GoogleCloud

Description

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query parameter.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Google Cloud Agent Development Kit (ADK)

Default version status: unaffected

  • 1.9.0 to < 1.22.0affected

References