CVE-2026-107858 Google CVE debrief

Who should care

Developers and administrators using Google ADK for Java should assess exposure and prioritize patching to version 1.13.0 or later, considering potential impacts on locally running agents and data access. This includes reviewing current deployments, identifying affected systems, and planning updates or mitigations through normal change control. Additionally, they should verify the same-origin default for CORS and the /run_live WebSocket endpoint, and review

Why it matters

CVE-2026-107858 is a high-severity vulnerability allowing remote attackers to control locally running agents and read their data. Developers and administrators should prioritize patching to version 1.13.0 or later and assess exposure in their environments.

• Remote attackers can control locally running agents
• Read data from locally running agents
• Trigger registered tools and stream agent responses
• List, read, create, or delete sessions and artifacts

Technical summary

The vulnerability exists in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java, specifically in versions 0.1.0 before 1.13.0. The /run_live WebSocket endpoint accepts connections from any origin by default, and the REST API returns Access-Control-Allow-Origin: * by default. This allows a remote attacker to control a locally running agent and read its data via a malicious web page visited by a developer while the server is running.

Defensive priority

Developers and administrators should prioritize patching to version 1.13.0 or later, and assess exposure in their environments.

Recommended defensive actions

• Patch to version 1.13.0 or later
• Assess exposure in environments using Google ADK for Java
• Verify same-origin default for CORS and /run_live WebSocket endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond patching to version 1.13.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.