Login Request a demo
Critical severity · published Sep 9, 2026
CVE-2026-79696
Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
10.0
CVSS
0.7%
EPSS
No
On KEV
Description
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Agent Development Kit (ADK) for Python · Google Cloud
2.0.0 before 2.7.0 · source: vendor
Affected product
AD
Agent Development Kit (ADK) for Python
Google Cloud
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-79696
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-79696
github.com
https://github.com/google/adk-python/commit/a16f6da3314b8dcd9925884cd6fc7fc9ffdd570d
github.com
https://github.com/google/adk-python/releases/tag/v2.7.0