The vulnerability is caused by missing origin checks on the WebSocket /run_live endpoint and overly permissive CORS settings in the Google Agent Development Kit (ADK) for Java. Because the development server runs with no authentication and opens the WebSocket and REST API to any origin, a malicious webpage can communicate with a locally running agent, trigger registered tools, and read or modify its data. The flaw effectively allows an attacker to remotely control the agent and steal information, which constitutes remote code or command execution and data disclosure.

The affected products are Google Agent Development Kit (ADK) for Java and its Maven plugin. Versions prior to 1.13.0 (specifically 0.1.0 through 1.12.0 across both the adk-web server component and the plugin) are vulnerable. Developers employing these versions during local development expose the agent to the described attacks.

The CVSS score of 7.2 indicates a medium-to-high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, meaning no public exploitation cataloging yet. The likely attack vector is a developer’s web browser. If a developer opens a malicious webpage while the ADK server is running on localhost, the page can exploit the permissive CORS and connect to the /run_live WebSocket, sending control messages and reading responses. The absence of authentication and the default '*' origins mean that exploitation requires only a browser visit, making the attack trivial for an attacker who can host a malicious page.