Loading vulnerability…
Continuation forgery in Google ADK for Python tool confirmations
CVE-2026-18236 is an authorization flaw in Google Agent Development Kit (ADK) for Python versions prior to 2.5.0. The vulnerability affects the tool-confirmation flow used for sensitive tool invocations. An attacker who can manipulate or inject events into an agent session's history can forge a tool confirmation response and cause execution of an unauthorized tool. The issue exists because the confirmation-processing logic failed to verify that the target tool was registered to the executing agent, failed to confirm that the referenced tool actually required confirmation, and failed to ensure that the confirmation arguments matched the original tool-call event recorded in session history. These validation gaps allow a forged continuation to be accepted as if it were a legitimate approval for a pending tool action.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized tool execution within the affected ADK agent workflow. Depending on the capabilities exposed through registered tools, this can result in unauthorized actions, access to sensitive data, modification of data or state, and disruption of normal operations. The published severity assessment indicates high impact across confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure by preventing untrusted parties or components from manipulating or injecting session-history events, enforcing strict integrity controls around agent state and continuation data, and limiting the set and privilege of registered tools available to agents. Additional defensive controls should validate that confirmation events are cryptographically or logically bound to a specific pending tool invocation before execution is allowed.
Patch, then assume compromise.
Upgrade Google ADK for Python to version 2.5.0 or later. The fix adds validation to the confirmation flow to ensure the confirmed tool is registered to the executing agent, that the tool is one that actually requires confirmation, and that the confirmation parameters match the original tool-call event in session history.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.