CVE-2026-4810: Google Agent Development Kit code injection and missing authentication

Executive brief

A code injection and missing authentication vulnerability in Google Agent Development Kit (ADK) allows unauthenticated remote attackers to execute arbitrary code on the hosting server.

Affected products

• PyPI google-adk

References

• https://api.github.com/users/philrollet
• https://github.com/philrollet
• https://api.github.com/users/philrollet/gists%7B/gist_id%7D
• https://api.github.com/users/philrollet/repos
• https://avatars.githubusercontent.com/u/164873072?v=4
• https://api.github.com/users/philrollet/events%7B/privacy%7D