{"data":{"id":"b510de8f-0fec-4ce0-b205-eac99ec545ba","title":"GHSA-rg7c-g689-fr3x: Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability","summary":"A Code Injection and Missing Authentication flaw in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) affects Python (OSS), Cloud Run and GKE deployments. An unauthenticated remote attacker can execute arbitrary code on the server hosting the ADK instance.","solution":"Patched in versions 1.28.1 and 2.0.0a2. Customers need to redeploy the upgraded ADK to their production environments, and users running ADK Web locally need to upgrade their local instance.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-rg7c-g689-fr3x","publishedAt":"2026-04-13T09:31:33.000Z","cveId":"CVE-2026-4810","cweIds":["CWE-306"],"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["google-adk@>= 2.0.0a1, < 2.0.0a2 (fixed: 2.0.0a2)","google-adk@>= 1.7.0, < 1.28.1 (fixed: 1.28.1)"],"affectedPackageNames":["google-adk"],"affectedPackageRefs":["pypi:google-adk"],"affectedVendors":["Google"],"affectedVendorsRaw":["Google Agent Development Kit (ADK)"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.02211,"epssCheckedAt":"2026-10-10T04:57:24.299Z","kevDateAdded":null,"advisoryAliases":["GHSA-rg7c-g689-fr3x"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-04-13T09:31:33.000Z","capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}