CVE-2026-107858

Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java (com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plugin versions 0.3.0 before 1.13.0) allow a remote attacker to control a locally running agent and read its data via a malicious web page visited by a developer while the server is running. The /run_live WebSocket endpoint accepts connections from any origin by default (hardcoded via setAllowedOrigins("*") in versions 0.1.0 through 1.5.0, and defaulting to * via adk.web.cors.origins in versions 1.6.0 through 1.12.0), and since version 0.4.0 the REST API returns Access-Control-Allow-Origin: * by default. Because the server has no authentication and requests originate from the developer's browser (so binding to localhost does not prevent exploitation), a cross-origin page can send messages to the agent (triggering registered tools), stream agent responses, and list, read, create, or delete sessions and artifacts. In versions 1.6.0 through 1.12.0, users can mitigate the issue by setting the adk.web.cors.origins property to an explicit allowlist of trusted origins (such as http://localhost:8000). The vulnerability is fixed in version 1.13.0, which enforces a same-origin default for CORS and the /run_live WebSocket endpoint, and rejects DNS-rebinding requests over loopback.

• CWE-306
• CWE-942
• CWE-1385

• https://github.com/google/adk-java/commit/1ae5078072e13e101318e32833f1db323ef084e1
• https://github.com/google/adk-java/commit/5667d382ab5078a0d6e8f7184713a6bab767e004
• https://github.com/google/adk-java/commit/c2b087cbaf44f44d20dc946d8f2391506a2fce3d
• https://github.com/google/adk-java/issues/1257
• https://github.com/google/adk-java/pull/1222
• https://github.com/google/adk-java/releases/tag/v1.13.0
• https://github.com/google/adk-java/releases/tag/v1.6.0

Published

Oct 23, 2026

Last Modified

Nov 2, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107850Contao is an Open Source CMS. From version 5.7.1 until 5.7.1…4.3
• CVE-2026-107851Contao is an Open Source CMS. From version 5.7.0 until 5.7.1…4.3
• CVE-2026-107852Jexactyl is a customisable game management panel and billing…7.1
• CVE-2026-107854Jexactyl is a customisable game management panel and billing…5.4
• CVE-2026-107856CiviForm simplifies applications for government benefits pro…4.5
• CVE-2026-107857Mindwtr is a free offline-first task management application …4.4
• CVE-2026-10786Improper access control in the ticketing integration setting…6.5
• CVE-2026-107861The system control service on affected Kiloview E3 NDI encod…9.9
• CVE-2026-107862Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-107863Missing Authorization vulnerability in Codection Products Re…5.3
• CVE-2026-107864Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-107865Improper Neutralization of Input During Web Page Generation …6.5