CVE-2026-18236 in ADK
Summary
by MITRE • 07/29/2026
A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework did not verify if the target tool was registered to the executing agent, did not validate if the tool actually required confirmation, and did not match the confirmation arguments against the original tool call event in the history.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability resides within the Agent Development Kit framework where a fundamental flaw in the tool confirmation mechanism enables unauthorized execution of tools through continuation forgery. The security weakness stems from insufficient validation controls that should have been implemented to verify the legitimacy of tool confirmations before execution proceeds. Attackers can exploit this by manipulating or injecting events into the session history and subsequently forging tool confirmation responses that appear legitimate to the system. The vulnerability specifically targets the lack of proper registration verification, where the framework fails to confirm whether a target tool was actually registered to the executing agent. This absence of registration validation creates an attack surface where malicious actors can bypass normal access controls by simply presenting forged confirmation responses.
The technical implementation flaw manifests in three critical validation failures that together create the exploitable condition. First, the framework does not verify if the target tool was properly registered with the executing agent, allowing any tool to be executed regardless of its intended authorization status. Second, there is no validation to determine whether the tool actually requires confirmation before execution, meaning that tools that should not be executable without proper verification can be forced into execution. Third, the framework fails to match confirmation arguments against the original tool call event in the session history, eliminating any correlation checks between the initial request and the forged response. This lack of argument validation creates a scenario where attackers can craft confirmation responses with arbitrary parameters that will be accepted by the system.
The operational impact of this vulnerability extends beyond simple unauthorized execution to potentially enable more sophisticated attack chains within agent-based systems. An attacker could leverage this flaw to execute sensitive operations, access restricted resources, or manipulate system behavior through forged tool confirmations that appear legitimate to the agent framework. The vulnerability is particularly dangerous in environments where agents interact with critical infrastructure or handle sensitive data processing tasks, as it allows for privilege escalation and unauthorized access to system capabilities. This type of attack can be particularly challenging to detect since forged confirmations may appear normal within the session history, making it difficult for security monitoring systems to distinguish between legitimate and malicious activity.
This vulnerability maps directly to several cybersecurity standards and threat frameworks, specifically aligning with CWE-284 (Improper Access Control) and CWE-345 (Insufficient Verification of Data Authenticity). The weakness also corresponds to ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell) and T1566 (Phishing) when considering how attackers might leverage this vulnerability as part of broader attack campaigns. The lack of proper input validation and verification mechanisms creates a pathway for attackers to manipulate system behavior through crafted events that should normally be rejected by the framework's security controls.
Mitigation strategies should focus on implementing comprehensive validation checks within the agent framework's tool confirmation process. The primary defense involves adding registration verification to ensure tools are properly registered before execution, followed by confirmation requirement validation to verify if a tool actually needs confirmation. Additionally, argument correlation mechanisms must be implemented to match confirmation parameters against original tool call events in session history. Organizations should also consider implementing cryptographic signatures or message authentication codes for tool confirmations to prevent forgery attempts. Regular security audits and input validation testing should be conducted to ensure these controls remain effective against evolving attack techniques that might attempt to exploit similar validation gaps in agent-based systems.