CVE-2026-79707: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Google Cloud Agent Development Kit (ADK)

The vulnerability identified as CVE-2026-79707 involves improper limitation of a pathname to a restricted directory (CWE-22) in the builder endpoint of Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0. An unauthenticated attacker can exploit this by supplying a crafted file_path query parameter to read arbitrary files remotely. The issue affects the Python implementation of the ADK and is present in cloud-hosted services managed by Google.

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files on the system hosting the vulnerable Google Cloud ADK service. This can lead to unauthorized disclosure of sensitive information. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality.

Since this is a cloud-hosted service managed by Google, remediation is handled by the vendor. A patch is available, and Google is responsible for applying the fix server-side. Users should monitor official Google Cloud advisories for confirmation of patch deployment and ensure their environments are updated accordingly.