CVE-2026-4810: Remote Code Execution in Google Agent Development Kit (ADK)
A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance.
This vulnerability was patched in versions 1.28.1 and 2.0.0a2.
Customers need to redeploy the upgraded ADK to their production environments. In addition, if they are running ADK Web locally, they also need to upgrade their local instance.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4810?
CVE-2026-4810 is categorized as a critical remote code execution vulnerability, allowing unauthenticated remote attackers to execute arbitrary code.
How do I fix CVE-2026-4810?
To fix CVE-2026-4810, upgrade to Google Agent Development Kit (ADK) version 1.28.1 or 2.0.0a2.
Which versions are affected by CVE-2026-4810?
CVE-2026-4810 affects Google Agent Development Kit (ADK) versions 1.7.0 through 1.28.1 and pre-release versions 2.0.0a1 and 2.0.0a2.
Is authentication required to exploit CVE-2026-4810?
No, CVE-2026-4810 can be exploited by unauthenticated remote attackers.
What are the implications of CVE-2026-4810 for users?
If exploited, CVE-2026-4810 can lead to unauthorized access, system compromise, and execution of malicious code.