External risk intelligence

Google Cloud ADK for Python Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-79696

The vulnerability exists in a development toolkit (ADK) when used in environments like Cloud Run or GKE with pytest installed. While these environments can be internet-facing, development tools are not typically exposed to the public internet by design in common deployment patterns, making public reachability a possibility depending on the specific application configuration.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical code injection vulnerability exists in a Google Cloud development toolkit for Python. This flaw allows unauthenticated remote attackers to run arbitrary code by exploiting a crafted test session replay, potentially impacting systems deployed on Cloud Run and GKE.

Code can be injected remotely into development tools.
Affects cloud services and GKE if testing tools are present.
Confirm relevance and exposure for development environments.

Attack Path

How an attacker could exploit the issue

An unauthenticated remote attacker can execute arbitrary code by leveraging a crafted test session replay. This is possible in Google Cloud Agent Development Kit (ADK) for Python installations that include pytest. The vulnerability allows an attacker to trigger the execution of malicious code by sending a specially designed test session replay.

No authentication or special access needed.
Triggered by a crafted test session replay.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code by exploiting a crafted test session replay when pytest is installed in Google Cloud Agent Development Kit (ADK) for Python environments like Cloud Run or GKE.

System code and data at risk.
Code injection via crafted test session replay.
Arbitrary code execution possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

For this critical code injection vulnerability, application owners and platform teams are most likely responsible for remediation. The first practical move is to identify all instances of the affected development kit, confirm their exposure and business criticality, and then coordinate a plan for updates or mitigation.

Identify accountable application owners.
Verify affected development kit instances.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Google Cloud Agent Development Kit (ADK) for Python?

The ADK is a toolkit designed to help developers build and test applications specifically for Google Cloud environments. It streamlines integration with services like Cloud Run and Google Kubernetes Engine (GKE). It is intended for development and testing workflows, meaning it is typically found in environments where developers are actively building or debugging cloud-native services.

How does this code injection vulnerability work in CVE-2026-79696?

This flaw belongs to the Code Injection weakness class (CWE-184). It occurs when the software improperly handles data provided during a test session replay. Because the system fails to safely sanitize this input, an attacker can supply a malicious, crafted replay file that forces the application to execute arbitrary commands, effectively taking control of the process running the toolkit.

Do I need to be authenticated to trigger this flaw?

No. The vulnerability is exploitable by an unauthenticated remote attacker. You do not need valid credentials or prior access to the system to send the malicious payload. It is important to note that this specific flaw only triggers when the 'pytest' framework is installed alongside the affected versions of the ADK; if pytest is absent, this specific execution path is not available.

Is my environment at risk according to Halo Surface Signal?

Halo Surface Signal notes that while the ADK is a development tool not typically intended for public internet exposure, it can become reachable depending on your specific deployment configuration. If you have deployed Cloud Run or GKE instances that include these development testing tools and those services are accessible via the internet, your surface area is higher.

What should I do first to address CVE-2026-79696?

Your immediate priority is to locate all instances where the Google Cloud ADK for Python is deployed within your cloud infrastructure. Focus specifically on environments running versions 2.0.0 through 2.6.0 where pytest is also present. Once identified, work with the relevant application owners to plan an update to a secure version, prioritizing systems that have any form of network connectivity.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.