Executive brief
The Google Agent Development Kit (ADK), a framework used to build AI-driven agents, contains a vulnerability that allows an attacker to bypass security checks when an agent requests user confirmation for a task. By injecting malicious events into the agent's session history, an attacker can trick the system into executing unauthorized tools or commands without the user's actual consent. This could lead to unauthorized data access or the execution of sensitive operations that were supposed to be protected by a manual approval step.
Technical details
A continuation forgery vulnerability exists in the Google Agent Development Kit (ADK) prior to version 2.5.0. The framework failed to properly validate tool confirmation responses against the original session history. Specifically, it did not verify if the target tool was registered to the executing agent, did not validate if the tool actually required confirmation, and failed to match confirmation arguments against the original tool call event. An attacker capable of manipulating or injecting events into the session history can exploit these omissions to forge a tool confirmation response, leading to the execution of unauthorized tools with tampered arguments. The fix implements strict verification of the tools_dict, validates confirmation requirements, and ensures exact matching of function names and arguments in the session history.
Affected products
- Google Google-ADK (Python) < 2.5.0
Timeline
- 2026-07-16: patched: Fix committed to google/adk-python repository
- 2026-07-29: disclosed: CVE published and NVD entry created