Google Agent Development Kit for Python up to 1.39.0/2.6.x FileArtifactService exposure of resource

Summaryinfo

A vulnerability was found in Google Agent Development Kit for Python up to 1.39.0/2.6.x. It has been declared as critical. Affected by this issue is some unknown functionality of the component FileArtifactService. The manipulation results in exposure of resource. This vulnerability is reported as CVE-2026-115522. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Google Agent Development Kit for Python up to 1.39.0/2.6.x. Affected is some unknown processing of the component FileArtifactService. The manipulation with an unknown input leads to a exposure of resource vulnerability. CWE is classifying the issue as CWE-668. The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-115522 since 10/22/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/28/2026).

Upgrading to version 1.39.1 or 2.7.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Agent Development Kit for Python

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39.0
• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion