CVE-2026-18236

A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework did not verify if the target tool was registered to the executing agent, did not validate if the tool actually required confirmation, and did not match the confirmation arguments against the original tool call event in the history.

CVSS

No CVSS.

References

Link	Resource
https://github.com/google/adk-python/commit/c03f333769feaeaa9fe8910fbe95cb9f2d513f54

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en el Agent Development Kit (ADK) permite la falsificación de continuación en las confirmaciones de herramientas. Un atacante que es capaz de manipular o inyectar eventos en el historial de la sesión puede ejecutar herramientas no autorizadas falsificando una respuesta de confirmación de herramienta. Esto es posible porque el framework no verificó si la herramienta objetivo estaba registrada en el agente ejecutor, no validó si la herramienta realmente requería confirmación y no hizo coincidir los argumentos de confirmación con el evento de llamada a la herramienta original en el historial.

Information

Published : 2026-07-29 18:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-18236

Mitre link : CVE-2026-18236

CVE.ORG link : CVE-2026-18236

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-18236", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18236", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T18:08:28.435061Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@google.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@google.com", "affectedData": [{"vendor": "Google", "product": "Google-ADK", "versions": [{"status": "affected", "version": "< 2.5.0"}], "platforms": ["Python"], "defaultStatus": "unaffected"}]}], "published": "2026-07-29T18:16:52.140", "references": [{"url": "https://github.com/google/adk-python/commit/c03f333769feaeaa9fe8910fbe95cb9f2d513f54", "source": "cve-coordination@google.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@google.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework did not verify if the target tool was registered to the executing agent, did not validate if the tool actually required confirmation, and did not match the confirmation arguments against the original tool call event in the history."}, {"lang": "es", "value": "Una vulnerabilidad en el Agent Development Kit (ADK) permite la falsificaci\u00f3n de continuaci\u00f3n en las confirmaciones de herramientas. Un atacante que es capaz de manipular o inyectar eventos en el historial de la sesi\u00f3n puede ejecutar herramientas no autorizadas falsificando una respuesta de confirmaci\u00f3n de herramienta. Esto es posible porque el framework no verific\u00f3 si la herramienta objetivo estaba registrada en el agente ejecutor, no valid\u00f3 si la herramienta realmente requer\u00eda confirmaci\u00f3n y no hizo coincidir los argumentos de confirmaci\u00f3n con el evento de llamada a la herramienta original en el historial."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "cve-coordination@google.com"}