Live › vulnerability › CVE-2026-115522
Go to dashboardGoogle's Agent Development Kit for Python stores file artifacts without the app name in the path, so two apps sharing one storage root and the same user_id can list, read, overwrite or delete each other's artifacts. An attacker who controls one such app gets access to the other app's stored files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 05:31 UTC. All times on this page are UTC.
Teams running google-adk 1.19.0 through before 1.39.1, or 2.0.0a1 through before 2.7.0, that use FileArtifactService with a root directory shared by more than one application. Exposure also needs the applications to use the same user_id, and session_id for session-scoped artifacts. Single-app deployments and those using other artifact services can skip it.
No product ranges from the sources yet.
pip show google-adk and compare the version against the fixed releases.FileArtifactService in your code and check whether more than one application points at the same root directory.root/users/{user_id}/ rather than root/apps/{app_name}/users/{user_id}/.1.39.1 or later.2.7.0 or later; 2.6.0 still reads the legacy root/users/{user_id} path.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.
This page as .md · .json · in your agent: get_signal("CVE-2026-115522")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.