CVE-2026-79696: Google ADK for Python Perfect-Score Code Injection, Unauthenticated RCE
Google Cloud Agent Development Kit for Python disclosed code injection CVE-2026-79696, CVSS 10.0. Versions 2.0.0 through 2.6.0 with pytest installed allow unauthenticated attackers to execute arbitrary code via a crafted test session replay.
Google Cloud disclosed a code injection in Agent Development Kit (ADK) for Python on 9 Sep 2026: CVE-2026-79696, CVSS 4.0 score 10.0. With pytest present, an unauthenticated remote attacker crafts a test session replay and executes arbitrary code as the `adk web` process. Hits OSS self-hosted deploys and ADK services on Cloud Run and GKE.
Incident Overview
ADK is Google's official open-source kit for building, evaluating, and debugging AI agents; commonly used to stand up agent backends fast. Affected: 2.0.0 through 2.6.0. Fixed: 2.7.0. Trigger requires pytest in the environment, so dev/test setups are the primary hit. Public exposure plus development mode magnifies risk. Reporter: Sanil Dulal. CNA: Google Cloud.
Technical Details
Root cause: CWE-184 Incomplete Denylist. ADK resolves code references in agent config against a hand-maintained dangerous-stdlib list. Example: `profile` blocked, `cProfile` missed. Several stdlib modules execute a string argument with no constructor — `cProfile.run`, `timeit.timeit`, `trace.Trace` — never added to the list, so they can be referenced directly as tools or callbacks.
Attack path: attacker crafts a test session replay payload. Recorded function calls dispatch onto resolved tools and callbacks; the attacker-specified stdlib reference runs as code. No account. No interaction. Classic unauthenticated RCE.
Impact Assessment
CVSS 4.0 vector: `AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H`. C/I/A all High. SSVC: automated exploitation feasible; no public in-the-wild evidence. Compromise yields full control of the host running the agent workload — cloud credentials, agent-logic tampering, lateral movement into the cloud. For orgs that expose agents as an external service, equivalent to exposing a dev/test interface as a remote-execution entry point.
Remediation
- Upgrade `google-adk` to 2.7.0 or later. That release replaces the hand-rolled denylist with the full Python stdlib set (`sys.stdlib_module_names` and `sys.builtin_module_names`), closing the bypass:
`pip install -U "google-adk>=2.7.0"
python -c "import google.adk, sys; print(google.adk.__version__)"`- Cannot upgrade immediately: do not expose `adk web` or any session-replay / test interface to untrusted networks. Intranet only.
- Strip pytest from production. Do not install non-essential test deps.
- Audit agent configs. Drop tool and callback references that point at stdlib functions. Keep only what you explicitly need.
- Tighten inbound rules for ADK workloads on Cloud Run and GKE. Check anomalous outbound connections and subprocess dispatch.
References
- CVE Record: CVE-2026-79696
- google/adk-python Release v2.7.0
- Fix commit: block full stdlib in agent-config code references
- IONIX Threat Center: CVE-2026-79696