CVE-2026-4810

CVE-2026-4810 is a code injection and missing authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 through 1.28.1, and 2.0.0a1 through 2.0.0a2, affecting Python open-source deployments, Cloud Run, and Google Kubernetes Engine (GKE) environments. This vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected ADK servers, representing a critical integrity and confidentiality threat. The vulnerability combines code injection flaws with missing authentication controls, creating an unauthenticated attack vector with likely low complexity requirements. The flaw enables remote code execution, which presents severe potential impact including unauthorized system access, data exfiltration, and service disruption. Organizations must immediately redeploy patched versions 1.28.1 or 2.0.0a2 to production environments, including local ADK Web instances. There are no indicators of active exploitation in public CVE lists, and the vulnerability is not tracked on the Known Exploited Vulnerabilities (KEV) catalog. However, the FAUCET Risk Score of 53.0 out of 100 and EPSS score of 0.00145 suggest moderate practical risk requiring prioritized remediation. Community attention remains low at present, but the unauthenticated remote code execution capability warrants urgent patching regardless of current exploitation status.