Google's AI agent toolkit, the Agent Development Kit (ADK) for Python (`google-adk` on PyPI), has a CVSS v4.0 10.0 (CRITICAL) code injection: CVE-2026-79696. The advisory states the affected range as 2.0.0 through 2.6.0, fixed in 2.7.0 (released 13 August 2026).
What happens: on a host that is running `adk web` and has pytest installed, an attacker sends a crafted test session replay and gets arbitrary code execution without authenticating. The advisory names Python (OSS), Cloud Run and GKE as the environments where this applies.
The latest release as of 9 September 2026 is 2.8.0 (26 August). If `google-adk` is installed anywhere — development machine or production — check the version first.
Do this now
- ✓Check the installed version. `pip show google-adk` and read the Version line, or `pip list | grep google-adk`
- ✓Update to 2.7.0 or later. `pip install -U google-adk`. The latest as of 9 September 2026 is 2.8.0
- ✓Update even if you are on 2.6.1, 2.6.2 or 2.6.3. The advisory range reads "2.0.0 through 2.6.0", but we verified in the source that the fix is absent from all three (details below)
- ✓Do not expose `adk web` to the internet. It is a development web UI. If you run it on Cloud Run or GKE, check its exposure and authentication settings right now
- ✓Drop pytest from production images. The advisory names "environments where pytest is installed" as a condition, so the ordinary discipline of keeping test dependencies out of production containers is itself a mitigation
- ✓Do not load agent YAML you do not trust. As explained below, even after the fix, naming a third-party package is still resolved
Where this score comes from. The 10.0 above is the CVSS v4.0 score assigned by Google, the CNA for this CVE. The vector is `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`. GitHub's security advisory GHSA-q9cv-5mjc-7cjc carries the same v4.0 score of 10.0 CRITICAL.
NVD does not yet carry a Primary score from NIST itself. As of 9 September 2026 the record status is `Received` and no v3.1 score is attached, so a different number may appear later. The weakness class is CWE-184 (Incomplete List of Disallowed Inputs).
It is not listed in CISA's KEV catalog as of 9 September 2026.
The defect: the denylist had holes
ADK lets you describe an agent in YAML. Inside that config, "code references" name the Python functions and classes used as tools and callbacks. Guarding that path was a denylist of dangerous standard-library modules, listed by name.
The fix commit describes the problem exactly. The denylist named dangerous modules one at a time, so anything it missed stayed reachable. It had `profile` but not `cProfile`; it had `pdb` but not `bdb`, `trace`, `timeit` or `pydoc`.
And then the maintainers write this: "Several of those execute a string you hand them and need no constructor `args`, so naming one as a tool or callback slipped past both existing mitigations and ran arbitrary code."
In other words, the design itself — enumerate the dangerous things and block them — was what broke. CWE-184, Incomplete List of Disallowed Inputs, is the name for precisely this shape.
The fix blocks the entire standard library
The change that landed in 2.7.0 does not add more entries to the denylist. It flips the direction of the check.
From the message of fix commit a16f6da (7 August 2026)
Block the standard library outright via `sys.stdlib_module_names`.
Configs only ever name the agent's own package, `google.adk`, or a
third-party integration, so nothing legitimate breaks and the list
stops needing a revisit every Python release.`sys.stdlib_module_names` is Python's own set of standard-library module names. Using it instead of an enumerated list means the block keeps up automatically as Python adds modules. The explicit denylist survives only for names that are no longer reported as standard library but remain importable, such as `distutils` and CPython's `test` packages.
About that range: 2.6.1 through 2.6.3 are unpatched too
This section reports what we checked in the source ourselves.
The advisory gives the affected range as "2.0.0 through 2.6.0", but PyPI also has 2.6.1 (31 July), 2.6.2 (4 August) and 2.6.3 (7 August). Read literally, those three fall outside the stated range. So we pulled `src/google/adk/agents/config_agent_utils.py` from six tags — 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.7.0 and 2.8.0 — and compared them.
- ▸v2.6.0, v2.6.1, v2.6.2 and v2.6.3: none of the four uses `sys.stdlib_module_names`, and all four files are 9,988 bytes with an identical SHA-256 (`9c39ecfc30ceb4d0…`) — they are literally the same file, and all four are unpatched
- ▸v2.7.0: uses `sys.stdlib_module_names` (11,296 bytes, patched)
- ▸v2.8.0: same (12,298 bytes, patched)
So no 2.6.x release carries the fix. Do not conclude that moving to 2.6.1 put you outside the range. Going to 2.7.0 or later is the only remedy.
For what it is worth, the fix commit is dated 7 August 2026, the same day 2.6.3 was published. It shipped in the next minor release, 2.7.0, on 13 August.
The maintainers say themselves that this is not closed
The commit message ends like this: "A denylist still cannot cover third-party packages, which the loader resolves by name, so this narrows the surface rather than closing it."
That caveat matters. Even on 2.7.0 and later, a third-party package named in an agent's YAML config will still be resolved. Updating is mandatory, but do not stop there: know whose YAML your agent is loading. The dividing line is whether your service loads configuration handed to it by a user.
The takeaway
A denylist freezes at the knowledge of the day it was written. Here, whoever wrote `profile` forgot `cProfile`, and whoever wrote `pdb` forgot `bdb`. Add one module in the next Python release and the list is stale again. A design that enumerates the dangerous things loses whenever a single one is missed — it is a bad bet by construction.
The patched shape is the opposite: let through only what is allowed. Once you decide that an agent config may only name its own package, `google.adk`, or an integration, you can drop the entire standard library mechanically and nothing legitimate breaks. When validating input, ask first whether it can be written as an allowlist.
One more thing. `adk web` is a development UI. Agent toolkits usually ship a local UI and debugging features that assume only a developer will ever touch them. That assumption dies the moment the thing is deployed to Cloud Run or GKE. Keeping the development UI and the test dependency (pytest) out of production is ordinary hygiene — and here it happened to be the mitigation as well.