CVE-2026-18236: Agent Development Kit Auth Bypass Flaw

CVE-2026-18236 Overview

CVE-2026-18236 is an authorization flaw in Google's Agent Development Kit (ADK) for Python. The framework fails to properly validate tool confirmation responses inside an agent session history. An attacker who can manipulate or inject events into the session history can forge a tool confirmation and trigger execution of unauthorized tools. The framework never checks whether the target tool is registered to the executing agent, whether the tool actually required confirmation, or whether the confirmation arguments match the original tool call event. The weakness maps to [CWE-863] Incorrect Authorization and affects agent workflows that rely on confirmation gates for sensitive tool invocations.

Critical Impact
Session history manipulation enables continuation forgery, allowing unauthorized tool execution within ADK-based AI agents with full confidentiality, integrity, and availability impact.

Affected Products

Google Agent Development Kit (adk-python)
AI agents built using ADK tool confirmation workflows
Downstream applications embedding ADK session state

Discovery Timeline

2026-07-29 - CVE-2026-18236 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18236

Vulnerability Analysis

The ADK exposes a tool confirmation mechanism intended to gate sensitive actions behind an explicit approval event in the session history. The framework processes a confirmation response and continues execution of the referenced tool call. The confirmation handler trusts the confirmation event without cross-checking it against the originating tool call. An attacker who controls or influences session events can inject a synthetic confirmation that references any tool name and any arguments. The agent then executes that tool as if the user or upstream policy had approved it.

Root Cause

Three missing checks combine to produce the authorization failure. The framework does not verify that the target tool is registered to the executing agent. It does not validate that the tool actually required confirmation. It does not match the confirmation arguments against the original tool call event stored in history. Together these gaps break the assumption that a confirmation event authorizes only its matching prior call.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker needs the ability to inject or modify session events, for example through prompt injection, a compromised upstream component, or a malicious tool return value that writes into history. The forged event drives the agent to invoke arbitrary tools with attacker-chosen arguments.

python

# Patch excerpt: src/google/adk/tools/base_tool.py
# Introduces an explicit check for whether confirmation is required

    # Use the consolidated logic in LlmRequest.append_tools
    llm_request.append_tools([self])

+  async def check_require_confirmation(
+      self, args: dict[str, Any], tool_context: ToolContext
+  ) -> bool:
+    """Returns whether the tool requires confirmation for the given args."""
+    return False
+
  @property
  def _api_variant(self) -> GoogleLLMVariant:
    return get_google_llm_variant()

Source: google/adk-python commit c03f333

Detection Methods for CVE-2026-18236

Indicators of Compromise

Tool invocations in agent logs that lack a corresponding prior tool call event in the same session history.
Confirmation events whose tool_name or arguments do not match any preceding call from the executing agent.
Execution of tools that are not registered to the agent handling the session.
Unexpected sensitive tool calls (file writes, API calls, shell execution) originating from agent sessions that used prompt-driven inputs.

Detection Strategies

Instrument ADK sessions to log each tool call and its matched confirmation event, and alert when the pair is missing or mismatched.
Correlate check_require_confirmation results against actual tool execution to surface bypasses.
Baseline the set of tools registered per agent and flag executions outside that set.

Monitoring Recommendations

Forward agent runtime logs to a centralized analytics pipeline for correlation of tool calls, confirmations, and outcomes.
Monitor outbound actions from agents (network requests, file changes, code execution) for deviations from expected tool usage.
Track session history integrity by hashing or signing events so injected entries can be detected.

How to Mitigate CVE-2026-18236

Immediate Actions Required

Upgrade adk-python to the version containing commit c03f333769feaeaa9fe8910fbe95cb9f2d513f54 or later.
Audit existing agent deployments for tools registered as requiring confirmation and review session logs for forged confirmations.
Restrict which components can write into session history and treat untrusted tool outputs as data, not events.

Patch Information

The fix landed in the google/adk-python repository. It adds a check_require_confirmation method to base_tool.py and hardens function_tool.py to validate confirmation context. The framework now enforces that a confirmation event corresponds to a real, prior tool call from a registered tool with matching arguments. See the ADK patch commit for full details.

Workarounds

Disable tool confirmation flows for agents that process untrusted input until patched.
Wrap tool dispatch with a custom validator that re-checks the tool name, agent registration, and argument equality against the originating call event.
Sanitize or strip synthetic events from session history before the agent loop consumes them.

bash

# Upgrade to a patched ADK build
pip install --upgrade google-adk

# Verify the installed commit contains the fix
python -c "import google.adk.tools.base_tool as b; print(hasattr(b.BaseTool, 'check_require_confirmation'))"