Google ADK Python EUVD-2026-74768

Exploitation requires that the target runs the 'adk web' interface from Google ADK for Python 2.0.0-2.6.0 AND that the pytest package is installed in that environment - the description explicitly ties the code-execution path to a crafted test session replay in a pytest-enabled deployment. The web interface must also be network-reachable to the attacker (OSS, Cloud Run, or GKE). Limiting factors: if pytest is absent, or if adk web is bound to localhost / behind authentication, the unauthenticated replay path is not reachable. No user interaction or prior authentication is needed once those conditions hold.

All available signals point to a genuinely serious issue: the vendor-supplied CVSS 4.0 vector is AV:N/AC:L/PR:N/UI:N with high vulnerable-system and subsequent-system impact (score 10.0), describing unauthenticated network-reachable RCE. The practical severity is moderated by two conditions in the description - pytest must be installed and the 'adk web' interface must be exposed - which are common in development and evaluation setups but not guaranteed in hardened production, so this reads more like a development/staging exposure than a universally exploitable production door; even a mid-sized operator in opole running exposed adk web dev servers should treat it as urgent and patch immediately. There is no EPSS score, KEV listing, or public POC in the provided data, so exploitation is not confirmed active and no public exploit code is identified; the U:Amber marking indicates restricted/coordinated disclosure. The primary caveat: raw CVSS 10.0 assumes the pytest-present, network-exposed configuration, which should be verified per deployment before treating every install as critical.

An attacker locates an internet-reachable 'adk web' instance built on ADK 2.0.0-2.6.0 with pytest present, crafts a malicious test session replay payload that bypasses the incomplete input filter, and submits it to the evaluation/replay endpoint. The replay is interpreted as executable code, granting the unauthenticated attacker arbitrary code execution on the Cloud Run, GKE, or OSS host. No public POC is currently identified, but the network-facing, no-privilege, no-interaction vector makes exploitation straightforward once the payload is developed.