CVE-2026-115522 Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python

Description

Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

Low

Interaction

None

Confidentiality

Low

Integrity

Low

Availability

None

Confidentiality of other systems

None

Integrity of other systems

None

Availability of other systems

None

Affected products and versions