Google ADK for Python: CVSS 10 RCE, upgrade to 2.7.0

A CVSS 10.0 remote code execution flaw landed in Google's Agent Development Kit for Python on September 9. CVE-2026-79696 lets an unauthenticated remote attacker execute arbitrary code through a crafted test session replay in adk web. If you built an agent on Google ADK and left the dev UI reachable, this is a same-day patch.

What actually happened

The GitHub advisory (GHSA-q9cv-5mjc-7cjc) is short and unambiguous: a code injection vulnerability in adk web "allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay." Affected versions are 2.0.0 through 2.6.0. Fixed in 2.7.0.

The weakness class is CWE-184, incomplete list of disallowed inputs — a blocklist that did not block enough. The advisory names Python OSS installs, Cloud Run and GKE as affected environments, with one precondition worth reading twice: pytest has to be installed in the environment. That is the difference between a container built from a lean production requirements file and one built from requirements-dev.txt because it was faster.

The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with high impact on confidentiality, integrity and availability, and high subsequent-system impact. Network reachable, low complexity, no privileges, no user interaction, and it does not stop at the process it lands in. That is how a 10.0 gets built.

Why this ADK vulnerability matters for your business

adk web is the local development UI. Nobody intends to run it in production. But agent projects are young, deployment paths are improvised, and "we spun it up on Cloud Run to show the client" is how a dev server acquires a public URL and a service account with real permissions attached.

That service account is the actual blast radius. An agent runtime is not a leaf service — it is provisioned to call your APIs, read your database, hit third-party tools, and hold the credentials for all of it. Code execution inside it is code execution with your agent's entire permission set. The CVE is a Python bug; the incident is a credential problem.

Three things to do today:

Pin the version, in writing. Run pip show google-adk in every environment that has one — laptop, staging, Cloud Run, GKE. Anything from 2.0.0 to 2.6.0 goes to 2.7.0 now.

Check whether pytest is in your production image. pip list | grep pytest on the running container. If it is there, ask why. Splitting dev and prod dependencies removes the precondition for this bug and for the next one shaped like it.

Confirm nothing serves adk web on a public interface. Then confirm it a second way — check your load balancer and ingress rules, not just your intent.

We deploy agent runtimes with separated dependency sets, scoped service accounts and no dev surface exposed, because the failure mode is never the framework alone. It is the framework plus the permissions you gave it.

Sources: GitHub Advisory GHSA-q9cv-5mjc-7cjc, NVD CVE-2026-79696.