CVE-2026-79707: Google Cloud ADK Path Traversal Vulnerability

CVE-2026-79707 Overview

CVE-2026-79707 is a path traversal vulnerability [CWE-22] in the builder endpoint of Google Cloud Agent Development Kit (ADK) for Python. Affected versions span 1.9.0 through 1.21.0. The flaw allows an unauthenticated remote attacker to read arbitrary files on the host by supplying a crafted file_path query parameter. Exposure of source code, configuration files, credentials, and cloud metadata becomes possible without any prior authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the server hosting an ADK builder instance, enabling secrets theft and follow-on cloud compromise.

Affected Products

Google Cloud Agent Development Kit (ADK) for Python 1.9.0
Google Cloud Agent Development Kit (ADK) for Python versions 1.9.0 through 1.21.0
Fixed in ADK for Python 1.22.0

Discovery Timeline

2026-09-04 - CVE-2026-79707 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-79707

Vulnerability Analysis

The Agent Development Kit (ADK) is Google's open-source Python framework for building and orchestrating LLM-driven agents. The framework includes a builder HTTP endpoint that accepts a file_path query parameter used to load agent assets from disk. Between versions 1.9.0 and 1.21.0, that parameter is passed to file-read operations without normalization or containment checks. An attacker can supply traversal sequences such as ../../../../etc/passwd to escape the intended base directory. The endpoint returns file contents in the HTTP response, turning the builder into an arbitrary-file-read primitive reachable over the network.

Because the endpoint requires no authentication, any network path to the ADK builder is sufficient for exploitation. Read access to files owned by the ADK process user allows retrieval of source code, .env files, service account JSON keys, and cloud instance metadata proxies mounted on disk.

Root Cause

The root cause is missing input sanitization on the file_path query parameter in the builder endpoint. The handler concatenates or resolves the user-supplied path without validating that the canonical path remains within an allowlisted directory. The upstream fix landed in commit 6f259f08b3c45ad6050b8a93c9bd85913451ece6 and is shipped in ADK 1.22.0, per the GitHub Change Log Entry.

Attack Vector

Exploitation requires a single unauthenticated HTTP GET request to the builder endpoint with a traversal payload in the file_path parameter. The request travels over the network, needs no privileges, and requires no user interaction. The vulnerability description and remediation are documented in the GitHub Commit Details. No public proof-of-concept exploit is currently listed in NVD, and the issue is not present on the CISA Known Exploited Vulnerabilities list.

Detection Methods for CVE-2026-79707

Indicators of Compromise

HTTP requests to ADK builder endpoints containing file_path= with traversal sequences such as ../, ..%2f, or absolute paths like /etc/passwd, /proc/self/environ, or /root/.config/gcloud/.
Access log entries showing repeated 200 responses to the builder endpoint with varying file_path values from a single source address.
Outbound requests from ADK hosts to unfamiliar destinations shortly after builder endpoint access, suggesting credential reuse.

Detection Strategies

Inspect reverse proxy and web application firewall logs for path traversal patterns targeting any ADK-hosted route accepting a file_path parameter.
Alert on unauthenticated access to internal ADK builder services from non-developer network segments.
Correlate ADK process file-read syscalls against sensitive paths such as /etc/shadow, cloud credential directories, and SSH key locations.

Monitoring Recommendations

Enable request logging on all ADK deployments and forward logs to a central SIEM for retention and query.
Baseline expected file_path values used by legitimate builder workflows and alert on deviations.
Monitor for anomalous access to service account key files and environment files on ADK hosts.

How to Mitigate CVE-2026-79707

Immediate Actions Required

Upgrade Google Cloud ADK for Python to version 1.22.0 or later on every host, container image, and development workstation running the framework.
Remove public network exposure of the ADK builder endpoint and restrict access to trusted developer networks.
Rotate any secrets, service account keys, and API tokens stored on or accessible from ADK hosts that were internet-reachable before patching.

Patch Information

Google addressed the vulnerability in ADK for Python 1.22.0. The fix is applied in commit 6f259f08b3c45ad6050b8a93c9bd85913451ece6 and documented in the project CHANGELOG. Upgrade using pip install --upgrade google-adk and rebuild any container images that pin an affected version.

Workarounds

Place the ADK builder behind an authenticating reverse proxy that rejects requests containing traversal sequences in query parameters.
Run ADK under a dedicated low-privilege user with filesystem access limited to a chroot or bind-mounted agent workspace.
Block the builder endpoint at the network layer in production environments where interactive agent building is not required.

bash

# Upgrade Google ADK for Python to a fixed release
pip install --upgrade 'google-adk>=1.22.0'

# Verify installed version
python -c "import google.adk, sys; print(google.adk.__version__)"