---
id: "CVE-2026-115522"
kind: "vulnerability"
aliases: ["CVE-2026-115522"]
title: "Google ADK: shared file artifact root lets apps read each other's artifacts"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "google-adk", "python"]
not_affected_if: ["non-shared-root", "other-artifact-service", "single-app-deployment"]
published_at: "2026-10-28T05:16:59+00:00"
first_seen_at: "2026-10-28T05:31:15+00:00"
updated_at: "2026-10-28T05:32:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115522", "first_seen_at": "2026-10-28T05:31:15+00:00"}]
---

# Google ADK: shared file artifact root lets apps read each other's artifacts

Google's Agent Development Kit for Python stores file artifacts without the app name in the path, so two apps sharing one storage root and the same user_id can list, read, overwrite or delete each other's artifacts. An attacker who controls one such app gets access to the other app's stored files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pip show google-adk` and compare the version against the fixed releases.
- Look for `FileArtifactService` in your code and check whether more than one application points at the same root directory.
- On disk, check whether artifacts sit under `root/users/{user_id}/` rather than `root/apps/{app_name}/users/{user_id}/`.

## Fix

- Upgrade google-adk 1.x to `1.39.1` or later.
- Upgrade google-adk 2.x to `2.7.0` or later; 2.6.0 still reads the legacy `root/users/{user_id}` path.
- Give each application its own FileArtifactService root directory until upgraded.

## Timeline

- 2026-10-28T05:31:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115522

## From the sources

Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_