Vulnerability · Published Jul 29, 2026 · Assigned by Google
CVE-2026-18236Google-ADK Continuation Forgery
Critical 9.3
In plain English
A critical-severity incorrect authorization in Google-ADK from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework did not verify if the target tool was registered to the executing agent, did not validate if the tool actually required confirmation, and did not match the confirmation arguments against the original tool call event in the history.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google-ADK | < 2.5.0 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P