CVE-2026-107858: Agent Development Kit (ADK) for Java 0.1.0 to before 1.13.0, 0.3.0 to before 1.13.0

Affected technology

Agent Development Kit (ADK) for Java · 0.1.0 to before 1.13.0
Google

Agent Development Kit (ADK) for Java · 0.3.0 to before 1.13.0
Google

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

A remote attacker can control a locally running agent and read its data via a malicious web page visited by a developer while the server is running. Vendor/CNA’s CVSS 4.0 assessment (base score 7.2/10) rates confidentiality impact as high; integrity and availability impact as low.