Which versions of Google ADK are affected by CVE-2026-18236?

Google's Agent Development Kit for Python (adk-python) contains a critical authorization bypass (CVSS 9.3) that allows attackers with access to an agent's session history to forge tool confirmations…. A patch is available.

How to fix or mitigate CVE-2026-18236?

Within 24 hours, inventory all deployments of adk-python and identify agents configured with tool confirmation requirements; assess whether these agents process sensitive operations or data access. Within 7 days, apply the upstream commit fix by rebuilding affected agents from the patched source repository, as no tagged vendor release is currently available-coordinate with development teams to test and deploy the fix in staging environments first. Within 30 days, implement application-level monitoring to log all tool execution requests and confirmations, and conduct a security review of any tool execution logs from the vulnerability window to identify unauthorized activity.

Google ADK CVE-2026-18236

Q: What is the CVSS score of CVE-2026-18236?

CVE-2026-18236 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50437 CRITICAL

Incorrect Authorization (CWE-863)

2026-07-29 Google

GHSA-8qg5-x5vm-75jx

Authentication Bypass Google Google Adk

9.3

CVSS 4.0 · Vendor: Google

Severity by source

Vendor (Google) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

AC:H because the attacker must be able to inject/forge matching events into session history; PR:N since injection can arrive via untrusted content/components without prior auth; S:C and C/I/A:H reflect unauthorized tool execution crossing the authorization boundary.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Google).

CVSS VectorVendor: Google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 29, 2026 - 19:02 EUVD

Source Code Evidence Fetched

Jul 29, 2026 - 18:31 vuln.today

Analysis Generated

Jul 29, 2026 - 18:31 vuln.today

CVE Published

Jul 29, 2026 - 17:37 cve.org

CRITICAL 9.3

DescriptionCVE.org

A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework did not verify if the target tool was registered to the executing agent, did not validate if the tool actually required confirmation, and did not match the confirmation arguments against the original tool call event in the history.

AnalysisAI

Authorization bypass in Google's Agent Development Kit (adk-python) lets an actor who can inject or manipulate events in an agent's session history forge a tool-confirmation response and force execution of tools that were never approved. The human-in-the-loop confirmation gate is defeated because the framework never verified that the confirmed tool was registered to the executing agent, that the tool actually required confirmation, or that the confirmation arguments matched the original tool-call event. No CISA KEV listing and no standalone public exploit were provided, though the CVSS 4.0 vector carries E:P (proof-of-concept exploit maturity); remediation is an upstream commit rather than a tagged release.

Technical ContextAI

Google ADK is an open-source Python framework (adk-python) for building LLM-driven agents that can call registered tools. Sensitive tools can be gated behind a 'tool confirmation' step: the agent emits a request_confirmation function call and waits for an approving response before executing. The flaw is in flows/llm_flows/request_confirmation.py, specifically the _resolve_confirmation_targets logic that maps an incoming confirmation back to the original function call. This maps to CWE-863 (Incorrect Authorization): the authorization check existed but trusted attacker-controllable data. The confirmation handler accepted an 'originalFunctionCall' supplied in the response without cross-checking it against the authentic call in history, so an injected/forged confirmation event was honored as genuine approval.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in commit c03f333769feaeaa9fe8910fbe95cb9f2d513f54 (https://github.com/google/adk-python/commit/c03f333769feaeaa9fe8910fbe95cb9f2d513f54) or upgrade to the first published adk-python release that contains it once available. The patch adds three validations in _resolve_confirmation_targets: the tool must be registered to the executing agent, the tool must actually require confirmation (statically or as requested in history), and the confirmation's name and arguments must match the original function-call event. Until you can update, compensating controls are: restrict who and what can write events into the session/session-history store (treat session history as a trust boundary), isolate agents so one agent's or tenant's events cannot be injected into another's session, and minimize or disable exposure of confirmation-gated high-impact tools to sessions that process untrusted input; note the trade-off that disabling confirmation-gated tools reduces agent capability and locking down session-history writes may break legitimate multi-agent event flows.