CVE-2026-4810 Google Cloud CVE debrief

Who should care

Developers and administrators using Google Agent Development Kit (ADK) versions 1.7.0 through 1.28.1 should assess their exposure and prioritize upgrading to patched versions. This includes verifying current ADK versions in production environments and planning for vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams and operators must review the supplied official advisory or CVE record tovalidate

Why it matters

CVE-2026-4810 is a critical vulnerability in Google Agent Development Kit (ADK) that allows unauthenticated remote code execution. Developers and administrators must assess their exposure, prioritize upgrading to patched versions, and verify current ADK versions in production environments.

• Unauthenticated remote code execution requires immediate attention and remediation
• Potential for lateral movement and exploitation in Cloud Run and GKE environments
• Need for verification of current ADK versions and exposure in production environments

Technical summary

CVE-2026-4810 is a critical vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 through 1.28.1 on Python (OSS), Cloud Run, and GKE. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code on the server hosting the ADK instance. The vulnerability was patched in versions 1.28.1 and 2.0.0a2. Developers and administrators using Google Agent Development Kit (ADK) versions 1.7.0 through 1.28.1 should assess their exposure and prioritize upgrading to patched versions. The vulnerability allows unauthenticated remote code execution, requiring immediate attention and remediation.

Defensive priority

High

Recommended defensive actions

• Upgrade ADK instances to version 1.28.1 or 2.0.0a2
• Redeploy upgraded ADK to production environments
• Upgrade local ADK Web instances
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, additional information from other sources is limited. The vendor has provided patch information, but further context is needed for comprehensive risk assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.