Cases / REG-0039
Google Agent Development Kit (ADK) for Java: a web page a developer visits can send messages to the agent running on the local ADK Web development server, triggering its registered tools, and read or delete its sessions, because the server has no authentication and accepted any origin by default; fixed in 1.13.0, CVE (Common Vulnerabilities and Exposures) record published 23 October 2026
Caught first by researchersSoftware agents · Enterprise work agentsMachine acts aloneDemonstration
What happened
A developer running an agent locally on ADK Web, the development web server of Google ADK for Java. The locally running agent served by ADK Web, through its /run_live WebSocket endpoint and REST API (com.google.adk:google-adk-dev 0.1.0 before 1.13.0; com.google.adk:google-adk-maven-plugin 0.3.0 before 1.13.0). Messages sent to the agent by a malicious web page the developer visits while the server is running; the requests originate from the developer's browser, so binding the server to localhost does not prevent them. not evidenced in source. The server has no authentication. The /run_live WebSocket endpoint accepts connections from any origin by default: hardcoded via setAllowedOrigins("*") in versions 0.1.0 through 1.5.0, and defaulting to * via adk.web.cors.origins in versions 1.6.0 through 1.12.0. Since version 0.4.0 the REST API returns Access-Control-Allow-Origin: * by default. Per the CVE record, a cross-origin page can send messages to the agent, triggering its registered tools, stream the agent's responses, and list, read, create or delete sessions and artifacts; the record states this as a capability and does not report that it happened. Outcome: averted by disclosure; none reported; Google, the CVE Numbering Authority, scores the flaw 7.2 (High) on version 4.0 of the Common Vulnerability Scoring System (CVSS, a severity score); NVD shows this score with status Received and has added none of its own; as of Oct 2026. The CVE record, as reproduced by a CVE-list mirror, credits George Chen (@geo-chen) and Gouri Sankar A (@g0w6y) as finders; the NVD copy does not show the credits.
Useful for a decision you face in the next 90 days?1 = not at all, 5 = I'd use it in that decision. One tap; it's saved with your reading code, not your name.
What helped more?
Would you forward this to your team?
Verification: 5 of 6 checks complete
✓ Structured and checkedevery claim typed and sourced, then checked by the Register's automated checker for missing sources and mistyped claims
✓ Sources linked6 of 6 sources link to the record (5 to a primary record)
✓ Sources checked claim by claimevery claim checked against its source on 2026-10-23
✓ Interpretation checked statement by statementeach statement of the Register's interpretation checked against a source on 2026-10-23
○ Reviewed by the editornot yet reviewed by a person
✓ Reply offeredGoogle: offered
Corrections · 5, latest 2026-10-23
Changes to what this case says, with the reason. Every earlier version is kept.
- 2026-10-23: Status text. Same as the status change.
Show the change
Before: Provisional (fix commits not opened in this run; no exploitation reported)After: Confirmed (fixed in 1.13.0, fix commits read; no exploitation reported) - 2026-10-23: Status. The only reason given for provisional status was that the fix commits had not been opened; both were read on 23 october 2026 and confirm the release notes, so the case takes the status of the comparable fixed cases (reg-0027, reg-0037).
Show the change
Before: provisionalAfter: confirmed - 2026-10-23: Fields: recovery technical. The two fix commits named in the release notes were read on 23 october 2026 with the editor present to approve the fetch (rule 21); the claim now states what they change instead of that they were not opened.
Show the change
Before: Fixed in version 1.13.0, which per the CVE record enforces a same-origin default for CORS (cross-origin resource sharing) and the /run_live WebSocket endpoint and rejects DNS-rebinding requests over loopback. The v1.13.0 release notes, dated 21 October 2026, list two fixes: allow only same-origin requests by default for CORS and /run_live (commit 5667d38), and reject DNS-rebinding requests that reach the server over loopback (commit 1ae5078); the commits were not opened in this run. For versions 1.6.0 through 1.12.0 the CVE record gives a mitigation: set adk.web.cors.origins to an explicit allowlist of trusted originsAfter: Fixed in version 1.13.0, which per the CVE record enforces a same-origin default for CORS (cross-origin resource sharing) and the /run_live WebSocket endpoint and rejects DNS-rebinding requests over loopback. The v1.13.0 release notes, dated 21 October 2026, list two fixes: allow only same-origin requests by default for CORS and /run_live (commit 5667d38), and reject DNS-rebinding requests that reach the server over loopback (commit 1ae5078). Both commits were read: the first changes the default of adk.web.cors.origins from * to an empty list, so a UI served from another origin must be listed; the second adds a filter that returns HTTP 403 to a request reaching a loopback-bound server with a Host or Origin that is neither loopback nor a listed origin. For versions 1.6.0 through 1.12.0 the CVE record gives a mitigation: set adk.web.cors.origins to an explicit allowlist of trusted origins - 2026-10-23: Fields: evidence event. Issue 1257 read on 23 october 2026 with the editor present to approve the fetch (rule 21: the agent run could not open it unattended); the claim now says what the issue reports instead of that it was not read.
Show the change
Before: CVE-2026-107858, assigned by Google as CVE Numbering Authority, reserved 8 October 2026 and published 23 October 2026; NVD lists it with status Received. It classifies the weaknesses as missing origin validation in WebSockets (Common Weakness Enumeration CWE-1385), permissive cross-domain policy with untrusted domains (CWE-942) and missing authentication for a critical function (CWE-306), and is scored by Google at CVSS 4.0 7.2 (High). Its references include issue 1257 on the project's repository, which was not opened in this runAfter: CVE-2026-107858, assigned by Google as CVE Numbering Authority, reserved 8 October 2026 and published 23 October 2026; NVD lists it with status Received. It classifies the weaknesses as missing origin validation in WebSockets (Common Weakness Enumeration CWE-1385), permissive cross-domain policy with untrusted domains (CWE-942) and missing authentication for a critical function (CWE-306), and is scored by Google at CVSS 4.0 7.2 (High). Its references include issue 1257 on the project's repository, the finder's report, which describes the same open defaults on the /run_live WebSocket endpoint and the REST API - 2026-10-23: Inference: value. Found in the source check of 23 october 2026: the cve record states the any-origin behaviour for the default configuration and gives a mitigation for 1.6.0 to 1.12.0 (an explicit adk.web.cors.origins allowlist); the sentence now says 'in its default configuration' and 'by default' (verification/reports/reg-0039-2026-10-23-sources.md).
Show the change
Before: The CVE record shows that any web page the developer opened while ADK Web was running could reach the local agent, because the server checked neither who was asking nor where the request came from, and that such a page could make the agent call its registered tools. The record does not say which tools a developer's agent would have, whether any of them asks the developer before running, or that any developer was attacked; per the record, version 1.13.0 enforces a same-origin default and rejects DNS-rebinding requests over loopbackAfter: The CVE record shows that, in its default configuration, any web page the developer opened while ADK Web was running could reach the local agent, because by default the server checked neither who was asking nor where the request came from, and that such a page could make the agent call its registered tools. The record does not say which tools a developer's agent would have, whether any of them asks the developer before running, or that any developer was attacked; per the record, version 1.13.0 enforces a same-origin default and rejects DNS-rebinding requests over loopback
Record history · 1 entry
- 2026-10-23: Right of reply offered to Google.
Controls that address what went wrong
1 control missing or failed. The line under each is the concrete form it would have taken in this case.
Actor identity verification
Absent: Mechanism: the server accepts messages to the agent from any page in the developer's browser, so a cross-origin page's requests are treated like the developer's own. Why it interrupts: if the server established who was sending a request (authentication, or a same-origin check binding requests to the developer's own UI), the page's messages would be refused before they reached the agent and its tools. Source shows it absent: the CVE record states the server has no authentication and the WebSocket endpoint accepts connections from any origin by default. the 1.13.0 fix is a same-origin default.
New cases like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.
Get the weekly emailHow it unfolded, layer by layer
MandateWhat it was told to do
Who deployed it: A developer running an agent locally on ADK Web, the development web server of Google ADK for Java. The task: not evidenced in source.
ActorWhat acted
The locally running agent served by ADK Web, through its /run_live WebSocket endpoint and REST API (com.google.adk:google-adk-dev 0.1.0 before 1.13.0; com.google.adk:google-adk-maven-plugin 0.3.0 before 1.13.0)
InputsWhat it could see
Messages sent to the agent by a malicious web page the developer visits while the server is running; the requests originate from the developer's browser, so binding the server to localhost does not prevent them
DecisionHow it chose
not evidenced in source
EnvelopeWhat it was allowed to do
Limits in place: The server has no authentication. The /run_live WebSocket endpoint accepts connections from any origin by default: hardcoded via setAllowedOrigins("*") in versions 0.1.0 through 1.5.0, and defaulting to * via adk.web.cors.origins in versions 1.6.0 through 1.12.0. Since version 0.4.0 the REST API returns Access-Control-Allow-Origin: * by default.
ActionWhat it did
Per the CVE record, a cross-origin page can send messages to the agent, triggering its registered tools, stream the agent's responses, and list, read, create or delete sessions and artifacts; the record states this as a capability and does not report that it happened
OutcomeWhat happened
Caught first by researchers. Severity: none reported; Google, the CVE Numbering Authority, scores the flaw 7.2 (High) on version 4.0 of the Common Vulnerability Scoring System (CVSS, a severity score); NVD shows this score with status Received and has added none of its own.
EvidenceWhat can be proven
Record of the event: CVE-2026-107858, assigned by Google as CVE Numbering Authority, reserved 8 October 2026 and published 23 October 2026; NVD lists it with status Received. It classifies the weaknesses as missing origin validation in WebSockets (Common Weakness Enumeration CWE-1385), permissive cross-domain policy with untrusted domains (CWE-942) and missing authentication for a critical function (CWE-306), and is scored by Google at CVSS 4.0 7.2 (High). Its references include issue 1257 on the project's repository, the finder's report, which describes the same open defaults on the /run_live WebSocket endpoint and the REST API.
RecoveryWhat could be stopped, undone, answered for
Technical recovery: Fixed in version 1.13.0, which per the CVE record enforces a same-origin default for CORS (cross-origin resource sharing) and the /run_live WebSocket endpoint and rejects DNS-rebinding requests over loopback. The v1.13.0 release notes, dated 21 October 2026, list two fixes: allow only same-origin requests by default for CORS and /run_live (commit 5667d38), and reject DNS-rebinding requests that reach the server over loopback (commit 1ae5078). Both commits were read: the first changes the default of adk.web.cors.origins from * to an empty list, so a UI served from another origin must be listed; the second adds a filter that returns HTTP 403 to a request reaching a loopback-bound server with a Host or Origin that is neither loopback nor a listed origin. For versions 1.6.0 through 1.12.0 the CVE record gives a mitigation: set adk.web.cors.origins to an explicit allowlist of trusted origins. Accountability: The CVE record, as reproduced by a CVE-list mirror, credits George Chen (@geo-chen) and Gouri Sankar A (@g0w6y) as finders; the NVD copy does not show the credits.
The same gap in other cases
Cases where the same control was missing or failed. Those in another world are the cross-domain comparisons the Register exists to make.
Cost and accountability
Severitynone reported; Google, the CVE Numbering Authority, scores the flaw 7.2 (High) on version 4.0 of the Common Vulnerability Scoring System (CVSS, a severity score); NVD shows this score with status Received and has added none of its own
AffectedNot recorded
Costnone reported
Regulatory or legal consequencenone
Technical recoveryTechnical recovery: Fixed in version 1.13.0, which per the CVE record enforces a same-origin default for CORS (cross-origin resource sharing) and the /run_live WebSocket endpoint and rejects DNS-rebinding requests over loopback. The v1.13.0 release notes, dated 21 October 2026, list two fixes: allow only same-origin requests by default for CORS and /run_live (commit 5667d38), and reject DNS-rebinding requests that reach the server over loopback (commit 1ae5078). Both commits were read: the first changes the default of adk.web.cors.origins from * to an empty list, so a UI served from another origin must be listed; the second adds a filter that returns HTTP 403 to a request reaching a loopback-bound server with a Host or Origin that is neither loopback nor a listed origin. For versions 1.6.0 through 1.12.0 the CVE record gives a mitigation: set adk.web.cors.origins to an explicit allowlist of trusted origins.
AccountabilityThe CVE record, as reproduced by a CVE-list mirror, credits George Chen (@geo-chen) and Gouri Sankar A (@g0w6y) as finders; the NVD copy does not show the credits
Draft interpretationWhy it matters beyond its domain. The CVE record shows that, in its default configuration, any web page the developer opened while ADK Web was running could reach the local agent, because by default the server checked neither who was asking nor where the request came from, and that such a page could make the agent call its registered tools. The record does not say which tools a developer's agent would have, whether any of them asks the developer before running, or that any developer was attacked; per the record, version 1.13.0 enforces a same-origin default and rejects DNS-rebinding requests over loopback. The Register's reading, not a fact; awaiting the editor's sign-off.
Right of reply
| Named party | Status | |
|---|---|---|
| Offered 2026-10-23; awaiting response | Respond for Google |