Which versions of Python are affected by CVE-2026-4810?

Google Agent Development Kit (ADK) versions 1.7.0-2.0.0a1 contain an unauthenticated remote code execution vulnerability affecting Python deployments, Cloud Run, and GKE environments.. A patch is available.

Is there a public PoC exploit available for CVE-2026-4810?

Yes, a public proof-of-concept exploit is available for CVE-2026-4810. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-4810?

Within 24 hours: Inventory all ADK deployments (Python OSS, Cloud Run, GKE) and identify instances running versions 1.7.0-1.28.0 or 2.0.0a1; immediately isolate exposed instances from production traffic via network segmentation or firewall rules. Within 7 days: Monitor vendor (Google) security advisories for patch release and evaluate migration to patched versions or alternative solutions; implement network-based ingress filtering to restrict ADK access to trusted sources only. Within 30 days: Deploy patched ADK version once released by vendor; conduct forensic review of exposed instances for indicators of compromise; execute code review of ADK integration points for injection vectors.

Python CVE-2026-4810

Q: What is the CVSS score of CVE-2026-4810?

CVE-2026-4810 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber. EPSS exploitation probability: 0.3%.

EUVD-2026-21900 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-04-13 GoogleCloud

GHSA-rg7c-g689-fr3x

Authentication Bypass RCE Python Google Agent Development Kit Adk Google Cloud

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 15, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 13, 2026 - 09:31 vuln.today

CVSS changed

Apr 13, 2026 - 09:22 NVD

9.3 (CRITICAL)

EUVD ID Assigned

Apr 13, 2026 - 09:15 euvd

EUVD-2026-21900

Analysis Generated

Apr 13, 2026 - 09:15 vuln.today

CVE Published

Apr 13, 2026 - 08:35 nvd

CRITICAL 9.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on google-adk (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.7.0.

DescriptionCVE.org

A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance.

This vulnerability was patched in versions 1.28.1 and 2.0.0a2.

Customers need to redeploy the upgraded ADK to their production environments. In addition, if they are running ADK Web locally, they also need to upgrade their local instance.

AnalysisAI

Remote code execution in Google Agent Development Kit (ADK) versions 1.7.0-1.28.0 and 2.0.0a1 allows unauthenticated remote attackers to execute arbitrary code on ADK server instances via combined code injection and missing authentication flaws. Affects Python OSS deployments, Cloud Run, and GKE environments. CVSS 9.3 critical severity with proof-of-concept code available (CVSS:4.0 E:P). No CISA KEV listing indicates no confirmed widespread exploitation at time of analysis, though the authentication bypass combined with RCE presents extreme risk for exposed instances.

Technical ContextAI

Google Agent Development Kit (ADK) is a framework for building AI agent applications on Google Cloud infrastructure. This vulnerability combines CWE-306 (Missing Authentication for Critical Function) with code injection, allowing attackers to bypass authentication controls entirely and inject malicious code into the ADK runtime environment. The affected CPE (cpe:2.3:a:google_cloud:agent_development_kit_(adk)) encompasses Python-based deployments across multiple hosting environments including open-source Python installations, Google Cloud Run serverless containers, and Google Kubernetes Engine clusters. The vulnerability spans major version 1.x (1.7.0 through 1.28.0) and alpha releases of version 2.x (2.0.0a1), indicating a long-standing architectural flaw in authentication enforcement. The CVSS 4.0 vector (AV:N/AC:L/PR:N) confirms network-accessible attack surface with low complexity and no privileges required, while the scope metrics (SC:H/SI:H/SA:H) indicate potential for cross-boundary impact affecting confidentiality, integrity, and availability of downstream systems beyond the vulnerable component itself.

RemediationAI

Immediately upgrade to Google Agent Development Kit version 1.28.1 for production 1.x deployments or version 2.0.0a2 for alpha 2.x deployments, as these releases contain the authentication and code injection patches per the vendor advisory at https://github.com/google/adk-python/blob/main/CHANGELOG.md#1274-2026-03-26. After upgrading package dependencies, customers must redeploy updated ADK instances to all production environments including Cloud Run services and GKE workloads, as the fix requires runtime application changes beyond library updates. Development teams running ADK Web locally must upgrade their local installations separately. Until patches can be deployed, implement network-level access controls to restrict ADK instance exposure exclusively to trusted IP ranges, deploy ADK behind authentication-enforcing reverse proxies or API gateways, and monitor ADK application logs for unexpected code execution patterns or unauthorized access attempts. Organizations unable to patch immediately should consider temporarily shutting down exposed ADK instances given the pre-authentication RCE risk and proof-of-concept availability.