Google ADK for Python hits CVSS 10.0: unauthenticated RCE, patch now
A crafted test-session replay in adk web executes code with no auth. LiteLLM and Starlette also shipped urgent fixes the same day.
Copy markdown
The flaw: a test replay that runs code
CVE-2026-79696 lands on the `adk web` component: an unauthenticated attacker sends a crafted test-session replay and gets remote code execution (CWE-184), scored CVSS 10.0. Anything running ADK for Python 2.0.0 through 2.6.0 with pytest installed is exposed.
Patch: get off 2.6.0 today
The affected range ends at 2.6.0, so upgrade to 2.6.1 or later; the current release is 2.8.0. Google patches its own hosted services, but self-managed agents on Cloud Run, GKE, or plain Python are yours to fix.
LiteLLM: an MCP auth bypass, fixed in 1.84.0
CVE-2026-59822 (CVSS 8.2): when OAuth2 passthrough validation fails, LiteLLM fell back to an empty `UserAPIKeyAuth()`, so a fabricated Bearer token could reach your MCP tools. Every build before 1.84.0 is affected, so bump your gateway.
Starlette: a Host-header bypass on CISA's KEV list
CVE-2026-48710 lets a spoofed Host header poison `request.url.path` and slip past path-based auth checks; it is now on CISA's Known Exploited Vulnerabilities list. Every FastAPI app inherits this, so upgrade Starlette to 1.0.1.
Audit your agent stack this afternoon
Three load-bearing pieces shipped fixes on Sept 9: an agent framework, an LLM gateway, and the web core under FastAPI. Pin the safe floors now: ADK 2.6.1+, LiteLLM 1.84.0+, Starlette 1.0.1+.