CVE-2026-4810 Details
Description
A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance. This vulnerability was patched in versions 1.28.1 and 2.0.0a2. Customers need to redeploy the upgraded ADK to their production environments. In addition, if they are running ADK Web locally, they also need to upgrade their local instance.
A code injection vulnerability combined with missing authentication has been identified in the Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2). This vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance. The issue is present in Python (OSS), Cloud Run, and GKE environments.
Users should upgrade to Google ADK versions 1.28.1 or 2.0.0a2. After upgrading, it is necessary to redeploy the ADK to production environments. If ADK Web is being run locally, the local instance must also be upgraded.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/google/adk-python/blob/main/CHANGELOG.md#1274-2026-03-26 | GoogleCloud |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | GoogleCloud |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | GoogleCloud |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | New CVE Received | GoogleCloud |