Description
A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query parameter.
Published: 2026-09-04
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote file read
Action: Immediate Patch
AI Analysis

Impact

A path traversal flaw in the builder endpoint of Google Cloud Agent Development Kit (ADK) allows an unauthenticated attacker to read any file on the system. The defect is tied to CWE‑22 and carries a CVSS score of 8.7, indicating serious risk when the vulnerability is exploited. An attacker can provide a crafted file_path query parameter and retrieve the contents of the target file.

Affected Systems

Google Cloud’s Agent Development Kit (ADK) version 1.9.0 through 1.21.0 running on Python are affected. The flaw specifically targets the builder endpoint exposed by the ADK.

Risk and Exploitability

The high CVSS score reflects significant confidentiality impact. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote unauthenticated request to the builder endpoint, which can be crafted over HTTP/HTTPS to a publicly reachable instance. If the ADK instance is world‑exposed, the flaw can be exploited without authentication or additional privileges.

Generated by OpenCVE AI on September 4, 2026 at 11:22 UTC.

Remediation

Vendor Solution

Upgrade google-adk to 1.22.0 or later.

OpenCVE Recommended Actions

  • Upgrade the google‑adk package to version 1.22.0 or newer.
  • Restrict exposure of the builder endpoint to authenticated users or internal networks, adding network layer protection such as firewalls or ACLs.
  • Implement monitoring of incoming requests to the builder endpoint for anomalous file_path values and log any traversal attempts for later analysis.

Generated by OpenCVE AI on September 4, 2026 at 11:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Google Cloud
Google Cloud agent Development Kit (adk)
Vendors & Products Google Cloud
Google Cloud agent Development Kit (adk)

Fri, 04 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query parameter.
Title Arbitrary File Read in Google Agent Development Kit (ADK)
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/U:Amber'}

Subscriptions

Google Cloud Agent Development Kit (adk)
cve-icon MITRE

Status: PUBLISHED

Assigner: GoogleCloud

Published:

Updated: 2026-09-04T16:13:53.072Z

Reserved: 2026-08-25T12:56:19.104Z

Link: CVE-2026-79707

cve-icon Vulnrichment

Updated: 2026-09-04T16:13:44.942Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-04T11:17:19.087

Modified: 2026-09-08T14:16:31.017

Link: CVE-2026-79707

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T11:30:17Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')