A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an… (CVE-2026-79707)

CVE-2026-79707 is a path traversal vulnerability affecting the builder endpoint in Google Cloud Agent Development Kit (ADK) for Python versions 1.9.0 through 1.21.0. An unauthenticated attacker can exploit this vulnerability by crafting a file_path query parameter to read arbitrary files on the system. The vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). No patch or vendor advisory detailing remediation is currently available. The vulnerability has a high severity rating based on the available data.

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files on the affected system, potentially exposing sensitive information. This can lead to information disclosure but does not indicate the ability to modify files or execute code based on the provided data. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the builder endpoint and monitor for suspicious requests involving file_path parameters. Avoid exposing the vulnerable endpoint to untrusted networks.