Read the docs
TI-2026-81678 Aliases CVE-2026-115522GHSA-hjvp-7px2-52j7

Cross-application artifact access in Google ADK for Python

Priority MEDIUM 57CWE-668Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Google Agent Development Kit (ADK) for Python (google-adk) versions from 1.19.0 before 1.39.1 and from 2.0.0a1 before 2.7.0 are affected. FileArtifactService omits app_name from on-disk artifact paths, which exposes resources to the wrong sphere (CWE-668). A low-privileged caller in one application can list, read, overwrite, or delete artifacts of another application that shares the same root directory and user_id. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00378 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial Agent Development Kit (ADK) for Python (Google): 1.39.1, 2.7.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleAgent Development Kit (ADK) for Python1.19.0 to before 1.39.1; 2.0.0a1 to before 2.7.01.39.1, 2.7.0Patch availableCNA
  • Agent Development Kit (ADK) for Python VendorGoogle Affected 1.19.0 to before 1.39.1; 2.0.0a1 to before 2.7.0 Fixed in 1.39.1, 2.7.0 Patch available CNA

Remediation

Upgrade Google Agent Development Kit (ADK) for Python to version 1.39.1 or 2.7.0. Red Hat lists OpenShift Lightspeed as affected with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA Agent Development Kit (ADK) for Python (Google) Fixed in 1.39.1, 2.7.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-115522
  2. 2026-10-28 Alias added: GHSA-hjvp-7px2-52j7
  3. 2026-10-29 Affected versions changed · Red Hat
  4. 2026-10-29 CVSS score added · Red Hat
  5. 2026-11-05 CISA SSVC decision points changed
  6. 2026-11-05 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 4

Other 2

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences