External risk intelligence

Google ADK Code Injection and Missing Authentication Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-4810

The Google Agent Development Kit (ADK) is deployed on Cloud Run and GKE, which are common hosting environments for web applications and API services. As these platforms are frequently used to host externally reachable services, there is a strong likelihood that an ADK instance would be exposed to the public internet in standard deployment patterns.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Google Agent Development Kit (ADK) for Python could allow unauthenticated attackers to execute arbitrary code on affected servers. This issue impacts deployments on Cloud Run and Google Kubernetes Engine, potentially exposing sensitive operations to unauthorized control.

Code injection allows unauthorized code execution.
Executive takeaway: Confirm ADK deployments and update.
Leadership concern: Potential for unauthorized server control.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a code injection vulnerability in the Google Agent Development Kit (ADK) by sending specially crafted requests to an exposed instance. This bypasses authentication, allowing them to execute arbitrary code on the server.

No authentication required for attack.
Triggered by sending malicious requests.
Allows arbitrary code execution on server.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could execute arbitrary code on the server hosting the ADK instance. This could occur when the ADK is deployed on vulnerable systems and exposed to the network, potentially impacting the confidentiality, integrity, and availability of the affected server.

Server code execution.
Remote code execution via network.
Compromise of server and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

Application owners and platform teams are most likely responsible for addressing this vulnerability, as it affects the Google Agent Development Kit (ADK) deployed on Cloud Run and GKE. The initial practical step is to inventory ADK instances, determine their reachability and criticality, and identify the accountable owner for remediation planning.

Identify ADK instances and ownership.
Verify external reachability and business impact.
Plan redeployment of patched ADK versions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Google Agent Development Kit (ADK)?

The Google Agent Development Kit (ADK) is a framework used by developers to build, test, and deploy intelligent agents. It is commonly implemented on platforms like Cloud Run and Google Kubernetes Engine (GKE), providing the underlying infrastructure for applications that interact with data or services. Because it supports various deployment modes, it is often utilized for both internal automation tasks and public-facing web services.

How does CVE-2026-4810 work?

This vulnerability involves a weakness known as CWE-306, which is a Missing Authentication issue. In the context of CVE-2026-4810, the ADK fails to verify the identity of someone connecting to it. This lack of security, combined with a code injection flaw, allows an attacker to send unauthorized commands that the server will execute as if they were legitimate instructions from an administrator.

Does every interaction with the ADK trigger this bug?

No. The vulnerability is triggered when an attacker sends specifically crafted malicious requests to an ADK instance. Legitimate traffic or standard interactions with the software do not automatically cause this issue. However, because the system lacks necessary authentication checks, it is unable to distinguish between valid requests and the malicious packets used to perform code injection.

Is my ADK instance at risk?

According to Halo Surface Signal, ADK instances are frequently deployed on platforms like Cloud Run and GKE to host web-accessible services. If your instance is configured to be reachable via the public internet, it faces a higher likelihood of being targeted. You should prioritize assessing any ADK deployments that are not restricted to internal-only network traffic.

What is the first step to address CVE-2026-4810?

The immediate priority is to identify all running ADK instances across your environment. Once you have an inventory, verify which instances are on vulnerable versions and check their network reachability. Finally, schedule a redeployment to update to the patched versions—1.28.1 or 2.0.0a2—to resolve the authentication and code injection risks.

References

github.com/google/adk-python/blob/main/CHANGELOG.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.