This vulnerability (CVE-2026-79696) involves incomplete filtering of disallowed inputs (CWE-184) in the adk web component of Google Cloud Agent Development Kit (ADK) for Python. It affects versions 2.0.0 through 2.6.0 running in Python OSS, Cloud Run, and GKE environments with pytest installed. The flaw allows unauthenticated remote attackers to execute arbitrary code by crafting a test session replay. The CVSS 4.0 base score is 10.0, reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is in a cloud service context, and Google manages patching for the cloud-hosted service. A patch is available, though no direct patch links are provided in the input data.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code remotely, potentially compromising confidentiality, integrity, and availability of affected systems. The vulnerability affects multiple deployment environments (Python OSS, Cloud Run, GKE) where pytest is installed, increasing the attack surface. The CVSS score of 10 indicates critical severity with full impact on security properties.

A patch is available for this vulnerability. Since the affected product is a cloud service, Google manages remediation for the cloud-hosted components. Users should apply the official patch or update to a fixed version as soon as possible. Check the official Google Cloud advisory for detailed patching instructions and confirmation of remediation status. No contradictory vendor guidance is provided.