CVE-2026-115522

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115522", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "state": "PUBLISHED", "assignerShortName": "Google", "dateReserved": "2026-10-22T18:18:29.284Z", "datePublished": "2026-10-28T04:36:49.927Z", "dateUpdated": "2026-11-05T17:01:12.141Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2026-10-28T04:36:49.927Z"}, "title": "Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python", "datePublic": "2026-07-29T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-668", "description": "CWE-668 Exposure of Resource to Wrong Sphere", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "Google", "product": "Agent Development Kit (ADK) for Python", "packageName": "google-adk", "repo": "https://github.com/google/adk-python", "versions": [{"status": "affected", "version": "1.19.0", "lessThan": "1.39.1", "versionType": "semver"}, {"status": "affected", "version": "2.0.0a1", "lessThan": "2.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Exposure of Resource to Wrong Sphere (CWE-668) in <code>FileArtifactService</code> in Google Agent Development Kit (ADK) for Python (<code>google-adk</code>) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a <code>FileArtifactService</code> root directory and use the same <code>user_id</code> (and <code>session_id</code> for session-scoped artifacts). <code>FileArtifactService</code> accepted <code>app_name</code> across its public API methods but omitted <code>app_name</code> when constructing on-disk paths (<code>root/users/{user_id}/...</code> instead of <code>root/apps/{app_name}/users/{user_id}/...</code>). Version 2.6.0 scoped writes by <code>app_name</code> but retained a legacy <code>root/users/{user_id}</code> fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.</p>"}]}], "references": [{"url": "https://github.com/google/adk-python/issues/5618", "tags": ["issue-tracking", "exploit"]}, {"url": "https://github.com/google/adk-python/pull/5619", "tags": ["patch"]}, {"url": "https://github.com/google/adk-python/commit/f72f0db58c5c1f4e8b8d4f04b8c592c9e49cbe9e", "tags": ["patch"]}, {"url": "https://github.com/google/adk-python/commit/c27d8688ed9ea619587ad96cbfd641c34dd7340c", "tags": ["patch"]}, {"url": "https://github.com/google/adk-python/commit/0ae2bffdd2628af6c8643bc4fd40c2f49f0c6bd4", "tags": ["patch"]}, {"url": "https://github.com/google/adk-python/releases/tag/v1.39.1", "tags": ["release-notes"]}, {"url": "https://github.com/google/adk-python/releases/tag/v2.7.0", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade Google Agent Development Kit (ADK) for Python (google-adk) to version 1.39.1 (for 1.x installations) or version 2.7.0 (for 2.x installations) or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade Google Agent Development Kit (ADK) for Python (<code>google-adk</code>) to version 1.39.1 (for 1.x installations) or version 2.7.0 (for 2.x installations) or later.</p>"}]}], "credits": [{"lang": "en", "value": "@Nant361", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T17:00:45.990624Z", "id": "CVE-2026-115522", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T17:01:12.141Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115522", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T17:00:45.990624Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T17:01:00.423Z"}}], "cna": {"title": "Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "@Nant361"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/google/adk-python", "vendor": "Google", "product": "Agent Development Kit (ADK) for Python", "versions": [{"status": "affected", "version": "1.19.0", "lessThan": "1.39.1", "versionType": "semver"}, {"status": "affected", "version": "2.0.0a1", "lessThan": "2.7.0", "versionType": "semver"}], "packageName": "google-adk", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade Google Agent Development Kit (ADK) for Python (google-adk) to version 1.39.1 (for 1.x installations) or version 2.7.0 (for 2.x installations) or later.", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrade Google Agent Development Kit (ADK) for Python (<code>google-adk</code>) to version 1.39.1 (for 1.x installations) or version 2.7.0 (for 2.x installations) or later.</p>", "base64": false}]}], "datePublic": "2026-07-29T00:00:00.000Z", "references": [{"url": "https://github.com/google/adk-python/issues/5618", "tags": ["issue-tracking", "exploit"]}, {"url": "https://github.com/google/adk-python/pull/5619", "tags": ["patch"]}, {"url": "https://github.com/google/adk-python/commit/f72f0db58c5c1f4e8b8d4f04b8c592c9e49cbe9e", "tags": ["patch"]}, {"url": "https://github.com/google/adk-python/commit/c27d8688ed9ea619587ad96cbfd641c34dd7340c", "tags": ["patch"]}, {"url": "https://github.com/google/adk-python/commit/0ae2bffdd2628af6c8643bc4fd40c2f49f0c6bd4", "tags": ["patch"]}, {"url": "https://github.com/google/adk-python/releases/tag/v1.39.1", "tags": ["release-notes"]}, {"url": "https://github.com/google/adk-python/releases/tag/v2.7.0", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.", "supportingMedia": [{"type": "text/html", "value": "<p>Exposure of Resource to Wrong Sphere (CWE-668) in <code>FileArtifactService</code> in Google Agent Development Kit (ADK) for Python (<code>google-adk</code>) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a <code>FileArtifactService</code> root directory and use the same <code>user_id</code> (and <code>session_id</code> for session-scoped artifacts). <code>FileArtifactService</code> accepted <code>app_name</code> across its public API methods but omitted <code>app_name</code> when constructing on-disk paths (<code>root/users/{user_id}/...</code> instead of <code>root/apps/{app_name}/users/{user_id}/...</code>). Version 2.6.0 scoped writes by <code>app_name</code> but retained a legacy <code>root/users/{user_id}</code> fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-668", "description": "CWE-668 Exposure of Resource to Wrong Sphere"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2026-10-28T04:36:49.927Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115522", "state": "PUBLISHED", "dateUpdated": "2026-11-05T17:01:12.141Z", "dateReserved": "2026-10-22T18:18:29.284Z", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "datePublished": "2026-10-28T04:36:49.927Z", "assignerShortName": "Google"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "google-adk", "product": "Agent Development Kit (ADK) for Python", "repo": "https://github.com/google/adk-python", "vendor": "Google", "versions": [{"lessThan": "1.39.1", "status": "affected", "version": "1.19.0", "versionType": "semver"}, {"lessThan": "2.7.0", "status": "affected", "version": "2.0.0a1", "versionType": "semver"}]}], "source": "cve-coordination@google.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping."}], "id": "CVE-2026-115522", "lastModified": "2026-11-05T17:17:42.093", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@google.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115522", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T17:00:45.990624Z", "version": "2.0.3"}}]}, "published": "2026-10-28T05:16:59.833", "references": [{"source": "cve-coordination@google.com", "url": "https://github.com/google/adk-python/commit/0ae2bffdd2628af6c8643bc4fd40c2f49f0c6bd4"}, {"source": "cve-coordination@google.com", "url": "https://github.com/google/adk-python/commit/c27d8688ed9ea619587ad96cbfd641c34dd7340c"}, {"source": "cve-coordination@google.com", "url": "https://github.com/google/adk-python/commit/f72f0db58c5c1f4e8b8d4f04b8c592c9e49cbe9e"}, {"source": "cve-coordination@google.com", "url": "https://github.com/google/adk-python/issues/5618"}, {"source": "cve-coordination@google.com", "url": "https://github.com/google/adk-python/pull/5619"}, {"source": "cve-coordination@google.com", "url": "https://github.com/google/adk-python/releases/tag/v1.39.1"}, {"source": "cve-coordination@google.com", "url": "https://github.com/google/adk-python/releases/tag/v2.7.0"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "cve-coordination@google.com", "type": "Secondary"}]}

{"bugzilla": {"description": "google-adk: google-adk: Unauthorized cross-application data access via improper storage path scoping", "id": "2562573", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562573"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-552", "details": ["Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.", "A flaw was found in the FileArtifactService component of Google Agent Development Kit (ADK). The service fails to isolate stored files by application name when constructing directory paths on disk. This issue allows a user in one application to access, overwrite, or delete stored files belonging to another application when both applications share the same storage root and use identical user or session identifiers."], "name": "CVE-2026-115522", "package_state": [{"cpe": "cpe:/a:redhat:openshift_lightspeed:1", "fix_state": "Fix deferred", "package_name": "openshift-lightspeed/lightspeed-agentic-sandbox-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed:2", "fix_state": "Fix deferred", "package_name": "openshift-lightspeed/lightspeed-agentic-sandbox-rhel9", "product_name": "OpenShift Lightspeed"}], "public_date": "2026-10-28T04:36:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115522\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115522\nhttps://github.com/google/adk-python/commit/0ae2bffdd2628af6c8643bc4fd40c2f49f0c6bd4\nhttps://github.com/google/adk-python/commit/c27d8688ed9ea619587ad96cbfd641c34dd7340c\nhttps://github.com/google/adk-python/commit/f72f0db58c5c1f4e8b8d4f04b8c592c9e49cbe9e\nhttps://github.com/google/adk-python/issues/5618\nhttps://github.com/google/adk-python/pull/5619\nhttps://github.com/google/adk-python/releases/tag/v1.39.1\nhttps://github.com/google/adk-python/releases/tag/v2.7.0"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.19.0,1.39.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.0.0a1,2.7.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Agent Development Kit (ADK) for Python", "source": "cna", "vendor": "Google"}, "product": "agent_development_kit_(adk)_for_python", "vendor": "google"}], "created": "2026-10-28T05:30:14.793548+00:00", "updated": "2026-10-30T02:45:07.654416+00:00", "vendors": ["google", "google$PRODUCT$agent_development_kit_(adk)_for_python"]}