CVE-2026-79696: Google Cloud ADK Python RCE Vulnerability

CVE-2026-79696 Overview

CVE-2026-79696 is a code injection vulnerability in the adk web component of Google Cloud Agent Development Kit (ADK) for Python. The flaw affects ADK versions 2.0.0 through 2.6.0 running on Python (OSS), Cloud Run, and Google Kubernetes Engine (GKE) environments where pytest is installed. An unauthenticated remote attacker can execute arbitrary code by submitting a crafted test session replay to the web interface. The weakness is classified under [CWE-184: Incomplete List of Disallowed Inputs].

Critical Impact
Unauthenticated remote code execution against ADK web servers with pytest installed, allowing full compromise of the host process in Python OSS, Cloud Run, and GKE deployments.

Affected Products

Google Cloud Agent Development Kit (ADK) for Python 2.0.0 through 2.6.0
ADK deployments on Cloud Run where pytest is installed
ADK deployments on Google Kubernetes Engine (GKE) where pytest is installed

Discovery Timeline

2026-09-09 - CVE-2026-79696 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79696

Vulnerability Analysis

The vulnerability resides in the agent-config code reference handling used by adk web. The component processes test session replay data and resolves Python module references through dynamic imports. When pytest is present in the runtime environment, an attacker can craft a session replay that references standard-library modules to reach code paths capable of executing arbitrary Python. Because the endpoint requires no authentication, exploitation is achievable over the network without prior access. The fix hardens the module allowlist so the entire Python standard library is blocked from being referenced through agent-config code paths.

Root Cause

The root cause is an incomplete disallowed-inputs list ([CWE-184]) in src/google/adk/agents/config_agent_utils.py. The prior implementation failed to exclude the full standard library, allowing references to modules such as importlib and sys to be resolved and invoked during replay processing. This enabled attacker-controlled code references to be evaluated at runtime.

Attack Vector

An unauthenticated attacker sends a crafted test session replay to an exposed adk web endpoint. The replay contains code references that pivot through permitted resolution logic into standard-library modules. When pytest is installed, this chain allows arbitrary Python execution in the ADK process context, affecting OSS, Cloud Run, and GKE deployments.

python

# Security patch excerpt: src/google/adk/agents/config_agent_utils.py
# fix: block the whole standard library in agent-config code references
 import importlib
 import inspect
 import os
+import sys
 from typing import Any
 from typing import List

Source: GitHub Commit a16f6da

Detection Methods for CVE-2026-79696

Indicators of Compromise

Unexpected inbound HTTP requests to adk web endpoints carrying serialized test session replay payloads from untrusted sources.
ADK worker processes spawning child processes such as sh, bash, python, or performing outbound network connections that deviate from baseline agent behavior.
Log entries in config_agent_utils referencing standard-library modules like os, sys, subprocess, or importlib during replay processing.

Detection Strategies

Inventory ADK Python deployments and flag any pod, container, or host running versions 2.0.0 through 2.6.0 with pytest installed alongside adk web.
Alert on process-lineage anomalies where the ADK web server parent process spawns interpreters, shells, or reconnaissance tooling.
Inspect ingress logs for POST requests to session replay routes originating from unauthenticated clients or untrusted networks.

Monitoring Recommendations

Enable runtime workload telemetry on Cloud Run and GKE nodes hosting ADK to capture syscall and process-execution events.
Forward ADK application logs and Kubernetes audit logs to a centralized data lake for correlation of replay traffic with process spawns.
Monitor egress from ADK workloads for connections to unfamiliar destinations following replay ingestion.

How to Mitigate CVE-2026-79696

Immediate Actions Required

Upgrade google-adk to version 2.7.0 or later in all Python, Cloud Run, and GKE environments.
Restrict network exposure of adk web so it is not reachable from untrusted networks or the public internet.
Remove pytest from production images that ship ADK unless it is explicitly required for the workload.

Patch Information

The fix is included in ADK Python v2.7.0. The change in GitHub Commit a16f6da blocks the entire standard library from being referenced through agent-config code paths. Release details are documented in the ADK Python v2.7.0 Release Notes.

Workarounds

Uninstall pytest from production runtime images to break the exploitation chain until the patch is applied.
Place adk web behind an authenticated reverse proxy or service mesh policy that denies anonymous access.
Apply Kubernetes NetworkPolicies or Cloud Run ingress controls to limit access to trusted client identities only.

bash

# Upgrade to the patched release
pip install --upgrade "google-adk>=2.7.0"

# Verify installed version
python -c "import google.adk, sys; print(google.adk.__version__)"

# Remove pytest from production images if not required
pip uninstall -y pytest