Agent Development Kit Adk For Java
Monthly
Google ADK for Java's development web server (ADK Web) accepts cross-origin connections by default, letting a malicious web page drive a locally running agent and read its data. The /run_live WebSocket endpoint allowed any origin (hardcoded setAllowedOrigins("*") in 0.1.0-1.5.0, default * via adk.web.cors.origins in 1.6.0-1.12.0) and, since 0.4.0, the REST API returned Access-Control-Allow-Origin: *; combined with the absence of authentication, a developer who visits an attacker-controlled page while the server runs can have tools triggered, responses streamed, and sessions and artifacts listed, read, created or deleted. Unauthenticated remote exploitation is possible per the CVSS vector (PR:N) but requires passive user interaction (UI:P) - the developer must open the malicious page while the dev server is up; a public PoC reference exists (GitHub issue 1257) but it is not verified as working exploit code, and no confirmed active exploitation was reported. Exposure is limited to a developer-facing dev server rather than a production service, and the complete fix is version 1.13.0.
Google ADK for Java's development web server (ADK Web) accepts cross-origin connections by default, letting a malicious web page drive a locally running agent and read its data. The /run_live WebSocket endpoint allowed any origin (hardcoded setAllowedOrigins("*") in 0.1.0-1.5.0, default * via adk.web.cors.origins in 1.6.0-1.12.0) and, since 0.4.0, the REST API returned Access-Control-Allow-Origin: *; combined with the absence of authentication, a developer who visits an attacker-controlled page while the server runs can have tools triggered, responses streamed, and sessions and artifacts listed, read, created or deleted. Unauthenticated remote exploitation is possible per the CVSS vector (PR:N) but requires passive user interaction (UI:P) - the developer must open the malicious page while the dev server is up; a public PoC reference exists (GitHub issue 1257) but it is not verified as working exploit code, and no confirmed active exploitation was reported. Exposure is limited to a developer-facing dev server rather than a production service, and the complete fix is version 1.13.0.