Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-4810
Not yet scoredAwaiting CVSS assessment
Published
April 13, 2026
Affected
1 project
Assigned by
f45cbf4e-4146-4068-b7e1-655ffc2c548c
Description
A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance. This vulnerability was patched in versions 1.28.1 and 2.0.0a2. Customers need to redeploy the upgraded ADK to their production environments. In addition, if they are running ADK Web locally, they also need to upgrade their local instance.
google/adk-python
GitHubAn open-source, code-first Python toolkit for building, evaluating, and deploying sophisticated AI agents with flexibility and control.
GitHubAn open-source, code-first Python toolkit for building, evaluating, and deploying sophisticated AI agents with flexibility and control.NVD