{"id":"CVE-2026-79707","title":"A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query …","summary":"A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query …","severity":"none","cwe":["CWE-22"],"published":"2026-09-04","updated":"2026-09-08","sourceUpdated":"2026-09-08T14:16:31.017","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79707","references":[{"url":"https://github.com/google/adk-python/blob/main/CHANGELOG.md#1220-2026-01-08","label":"f45cbf4e-4146-4068-b7e1-655ffc2c548c"},{"url":"https://github.com/google/adk-python/commit/6f259f08b3c45ad6050b8a93c9bd85913451ece6","label":"f45cbf4e-4146-4068-b7e1-655ffc2c548c"}],"tags":["nvd"],"epss":0.00446,"epssPercentile":0.38032,"ingestedAt":"2026-09-08T15:33:26.960Z","slug":"CVE-2026-79707","body":"## Overview\n\nA Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query parameter.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}