CVE-2026-115522

Google ADK file artifacts cross application namespaces

Google · Agent Development Kit for Python FileArtifactService

First documented disclosure · Review checkpoint

Summary

Applications sharing file storage can access or alter another application’s artifacts when user and session identifiers overlap.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed primary sources establish a vulnerability and controlled reproduction, not real-world malicious exploitation. CISA KEV 2026.10.27 contains no exact-ID match; absence is not proof of no exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

File paths omitted app_name. Version 2.6.0 scoped writes but retained a legacy fallback for reads and deletes.

Conditions required

Two applications share the FileArtifactService root and user_id; session-scoped artifacts also require matching session_id. A caller can invoke artifact operations.

Potential impact

Cross-application listing, reading, overwriting or deletion of artifacts. This is specific to the file backend and shared namespace configuration.

Affected versions and configurations

google-adk >=1.19.0,<1.39.1 and >=2.0.0a1,<2.7.0.

Fix and mitigation status

1.39.1 for 1.x; 2.7.0 for 2.x. Version 2.6.0 is incomplete.

Practical next steps

Upgrade to the fixed branch release and migrate legacy artifacts into the correct per-application directories; separate storage roots until isolation is enforced.

Operating lesson

Application identity must be part of every persistent artifact authorization boundary.

Evidence and limits

May7 public issue predates August13 release 2.7.0, August27 backport 1.39.1 and October28 CVE. A closed issue or 2.6.0 write-scoping alone does not establish complete read/delete isolation.

Sources