Executive brief
Google's Agent Development Kit (ADK) for Python is a framework used to build AI agents that run in cloud environments like Google Cloud Run and Kubernetes. A code injection vulnerability in the configuration loader allowed attackers to execute arbitrary Python code by crafting malicious test session replays, potentially compromising agent workloads and the data they access. The issue affected versions 2.0.0 through 2.6.0 and has been patched in version 2.7.0.
Technical details
The vulnerability was a code injection flaw in the ADK's YAML configuration loader, which used a denylist to block dangerous Python standard library modules from being invoked via code references. However, the denylist was incomplete: it named modules like `profile` and `pdb` but missed alternatives such as `cProfile`, `bdb`, `trace`, `timeit`, and `pydoc` that also execute arbitrary code with no constructor arguments required. An unauthenticated remote attacker could bypass both the denylist and existing mitigations by naming one of the missed modules as a tool or callback in a crafted test session replay. The fix (committed 2026-08-07) blocks the entire Python standard library outright via `sys.stdlib_module_names` rather than maintaining a per-release allowlist, since legitimate agent configurations only reference the `google.adk` package or third-party integrations. The patch was released in ADK v2.7.0 on 2026-08-13.
Affected products
- Google Agent Development Kit (ADK) for Python 2.0.0 through 2.6.0
Timeline
- 2026-09-09: disclosed: CVE-2026-79696 published on NVD
- 2026-08-13: patched: Fixed in ADK v2.7.0
- 2026-08-07: other: Patch commit a16f6da merged