{
 "schema_version": "0.4",
 "id": "REG-0039",
 "title": "Google Agent Development Kit (ADK) for Java: a web page a developer visits can send messages to the agent running on the local ADK Web development server, triggering its registered tools, and read or delete its sessions, because the server has no authentication and accepted any origin by default; fixed in 1.13.0, CVE (Common Vulnerabilities and Exposures) record published 23 October 2026",
 "batch": "agent-2026-10-23",
 "family": "software",
 "context": {
  "domain": "Software agent (agent framework, local development web server)",
  "autonomy_level": "alone",
  "autonomy_level_text": "Per the CVE record, a message sent to the agent triggers its registered tools; the record does not say whether any tool asks the developer before it runs",
  "actor_type": "Software: an agent run on the ADK Web development server of Google ADK for Java (com.google.adk:google-adk-dev 0.1.0 before 1.13.0; com.google.adk:google-adk-maven-plugin 0.3.0 before 1.13.0)",
  "actors": {
   "count": 1,
   "text": "1 agent; attacker as a web page the developer visits while the server is running",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "demonstration",
  "mandate_context_text": "Vulnerability disclosure; no exploitation reported in the sources read",
  "jurisdiction": [
   "Global (open-source framework)"
  ]
 },
 "actor_status": "confirmed",
 "provenance_tier": "disclosure_corroborated",
 "provenance_tier_text": "CVE record assigned by Google as CVE Numbering Authority and shown in NVD (National Vulnerability Database), corroborated by the project's v1.13.0 release notes; the fix commits and the linked issue were not opened in this run",
 "status": "confirmed",
 "status_text": "Confirmed (fixed in 1.13.0, fix commits read; no exploitation reported)",
 "outcome": {
  "state": "averted_by_disclosure",
  "severity": "none reported; Google, the CVE Numbering Authority, scores the flaw 7.2 (High) on version 4.0 of the Common Vulnerability Scoring System (CVSS, a severity score); NVD shows this score with status Received and has added none of its own",
  "affected_parties": [],
  "cost": "none reported",
  "regime_consequence": "none",
  "as_of": "Oct 2026",
  "derived_by": "agent"
 },
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "A developer running an agent locally on ADK Web, the development web server of Google ADK for Java",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-107858"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Mandate",
   "facet": "objective",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-107858"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": null,
   "value": "The locally running agent served by ADK Web, through its /run_live WebSocket endpoint and REST API (com.google.adk:google-adk-dev 0.1.0 before 1.13.0; com.google.adk:google-adk-maven-plugin 0.3.0 before 1.13.0)",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-107858"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "Messages sent to the agent by a malicious web page the developer visits while the server is running; the requests originate from the developer's browser, so binding the server to localhost does not prevent them",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-107858"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-107858"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "constraints",
   "value": "The server has no authentication. The /run_live WebSocket endpoint accepts connections from any origin by default: hardcoded via setAllowedOrigins(\"*\") in versions 0.1.0 through 1.5.0, and defaulting to * via adk.web.cors.origins in versions 1.6.0 through 1.12.0. Since version 0.4.0 the REST API returns Access-Control-Allow-Origin: * by default.",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-107858"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "Per the CVE record, a cross-origin page can send messages to the agent, triggering its registered tools, stream the agent's responses, and list, read, create or delete sessions and artifacts; the record states this as a capability and does not report that it happened",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-107858"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: averted by disclosure. No exploitation reported in the sources read. As of Oct 2026.",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-107858",
    "REL-1-13-0"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "CVE-2026-107858, assigned by Google as CVE Numbering Authority, reserved 8 October 2026 and published 23 October 2026; NVD lists it with status Received. It classifies the weaknesses as missing origin validation in WebSockets (Common Weakness Enumeration CWE-1385), permissive cross-domain policy with untrusted domains (CWE-942) and missing authentication for a critical function (CWE-306), and is scored by Google at CVSS 4.0 7.2 (High). Its references include issue 1257 on the project's repository, the finder's report, which describes the same open defaults on the /run_live WebSocket endpoint and the REST API.",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-107858",
    "CVE-COPY",
    "ISSUE-1257"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "Fixed in version 1.13.0, which per the CVE record enforces a same-origin default for CORS (cross-origin resource sharing) and the /run_live WebSocket endpoint and rejects DNS-rebinding requests over loopback. The v1.13.0 release notes, dated 21 October 2026, list two fixes: allow only same-origin requests by default for CORS and /run_live (commit 5667d38), and reject DNS-rebinding requests that reach the server over loopback (commit 1ae5078). Both commits were read: the first changes the default of adk.web.cors.origins from * to an empty list, so a UI served from another origin must be listed; the second adds a filter that returns HTTP 403 to a request reaching a loopback-bound server with a Host or Origin that is neither loopback nor a listed origin. For versions 1.6.0 through 1.12.0 the CVE record gives a mitigation: set adk.web.cors.origins to an explicit allowlist of trusted origins.",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-107858",
    "REL-1-13-0",
    "COMMIT-5667",
    "COMMIT-1AE5"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "The CVE record, as reproduced by a CVE-list mirror, credits George Chen (@geo-chen) and Gouri Sankar A (@g0w6y) as finders; the NVD copy does not show the credits",
   "assertion_type": "fact",
   "source_ids": [
    "CVE-COPY"
   ],
   "confidence": "medium",
   "disputed": false
  }
 ],
 "inference": {
  "value": "The CVE record shows that, in its default configuration, any web page the developer opened while ADK Web was running could reach the local agent, because by default the server checked neither who was asking nor where the request came from, and that such a page could make the agent call its registered tools. The record does not say which tools a developer's agent would have, whether any of them asks the developer before running, or that any developer was attacked; per the record, version 1.13.0 enforces a same-origin default and rejects DNS-rebinding requests over loopback.",
  "source_ids": [
   "NVD-107858",
   "REL-1-13-0"
  ],
  "confidence": "medium",
  "signed_by": null
 },
 "controls": {
  "failed": [],
  "succeeded": [],
  "absent": [
   {
    "id": "C-A1",
    "note": "Mechanism: the server accepts messages to the agent from any page in the developer's browser, so a cross-origin page's requests are treated like the developer's own. Why it interrupts: if the server established who was sending a request (authentication, or a same-origin check binding requests to the developer's own UI), the page's messages would be refused before they reached the agent and its tools. Source shows it absent: the CVE record states the server has no authentication and the WebSocket endpoint accepts connections from any origin by default; the 1.13.0 fix is a same-origin default.",
    "confidence": "high",
    "basis": "agent"
   }
  ]
 },
 "applicable_rules": [
  "None applicable"
 ],
 "unmapped": [],
 "named_parties": [
  {
   "name": "Google",
   "right_of_reply": {
    "offered": "2026-10-23",
    "response": null
   }
  }
 ],
 "sources": {
  "NVD-107858": {
   "title": "NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026)",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107858",
   "date": "2026-10-23",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-23"
  },
  "REL-1-13-0": {
   "title": "Release v1.13.0 (google/adk-java), dated 2026-10-21: bug fixes \"allow only same-origin requests by default for CORS and /run_live\" and \"reject DNS-rebinding requests that reach the server over loopback\"",
   "type": "company",
   "url": "https://github.com/google/adk-java/releases/tag/v1.13.0",
   "date": "2026-10-21",
   "tier": "company",
   "interest": "vendor describing its own release",
   "primary": true,
   "checked": "2026-10-23"
  },
  "CVE-COPY": {
   "title": "CVE-2026-107858 as reproduced from the CVE List by cve.threatint.com: assigner Google, reserved 2026-10-08, published 2026-10-23, CVSS 4.0 vector, finders' credits",
   "type": "public_record",
   "url": "https://cve.threatint.com/CVE/CVE-2026-107858",
   "date": "2026-10-23",
   "tier": "disclosure_corroborated",
   "interest": "third-party mirror of the CVE Numbering Authority's record; cve.org could not be opened in this run",
   "primary": false,
   "checked": "2026-10-23"
  },
  "COMMIT-5667": {
   "title": "fix(dev): allow only same-origin requests by default for CORS and /run_live (commit 5667d38)",
   "url": "https://github.com/google/adk-java/commit/5667d382ab5078a0d6e8f7184713a6bab767e004",
   "type": "company",
   "date": "2026-10-21",
   "note": "Read 23 October 2026 with the fetch tool, with the editor present to approve. Changes the default of adk.web.cors.origins from * to an empty list; the commit message says a UI served from another origin now needs adk.web.cors.origins.",
   "tier": "company",
   "interest": "vendor fix commit in its own repository",
   "primary": true,
   "checked": null
  },
  "COMMIT-1AE5": {
   "title": "fix(dev): reject DNS-rebinding requests that reach the server over loopback (commit 1ae5078)",
   "url": "https://github.com/google/adk-java/commit/1ae5078072e13e101318e32833f1db323ef084e1",
   "type": "company",
   "date": "2026-10-21",
   "note": "Read 23 October 2026 with the fetch tool, with the editor present to approve. Adds OriginGuardFilter: on a loopback-bound server a request whose Host is neither loopback nor a listed origin, or whose Origin over loopback is neither listed nor loopback, gets HTTP 403.",
   "tier": "company",
   "interest": "vendor fix commit in its own repository",
   "primary": true,
   "checked": null
  },
  "ISSUE-1257": {
   "title": "ADK dev web server allows all origins on the /run_live WebSocket and on the REST API, enabling cross-site WebSocket hijacking and cross-origin data theft (issue 1257)",
   "url": "https://github.com/google/adk-java/issues/1257",
   "type": "researcher",
   "date": null,
   "note": "Read 23 October 2026 with the fetch tool, with the editor present to approve. The finder's report, cited by the CVE record; the open date is not shown in the page text read.",
   "tier": "researcher",
   "interest": "the finder's report, cited by the CVE record",
   "primary": false,
   "checked": null
  }
 },
 "corrections": [
  {
   "date": "2026-10-23",
   "field": "inference.value",
   "old": "The CVE record shows that any web page the developer opened while ADK Web was running could reach the local agent, because the server checked neither who was asking nor where the request came from, and that such a page could make the agent call its registered tools. The record does not say which tools a developer's agent would have, whether any of them asks the developer before running, or that any developer was attacked; per the record, version 1.13.0 enforces a same-origin default and rejects DNS-rebinding requests over loopback.",
   "new": "The CVE record shows that, in its default configuration, any web page the developer opened while ADK Web was running could reach the local agent, because by default the server checked neither who was asking nor where the request came from, and that such a page could make the agent call its registered tools. The record does not say which tools a developer's agent would have, whether any of them asks the developer before running, or that any developer was attacked; per the record, version 1.13.0 enforces a same-origin default and rejects DNS-rebinding requests over loopback.",
   "reason": "Found in the source check of 23 October 2026: the CVE record states the any-origin behaviour for the default configuration and gives a mitigation for 1.6.0 to 1.12.0 (an explicit adk.web.cors.origins allowlist); the sentence now says 'in its default configuration' and 'by default' (verification/reports/REG-0039-2026-10-23-sources.md)."
  },
  {
   "date": "2026-10-23",
   "field": "fields.Evidence event",
   "old": "CVE-2026-107858, assigned by Google as CVE Numbering Authority, reserved 8 October 2026 and published 23 October 2026; NVD lists it with status Received. It classifies the weaknesses as missing origin validation in WebSockets (Common Weakness Enumeration CWE-1385), permissive cross-domain policy with untrusted domains (CWE-942) and missing authentication for a critical function (CWE-306), and is scored by Google at CVSS 4.0 7.2 (High). Its references include issue 1257 on the project's repository, which was not opened in this run.",
   "new": "CVE-2026-107858, assigned by Google as CVE Numbering Authority, reserved 8 October 2026 and published 23 October 2026; NVD lists it with status Received. It classifies the weaknesses as missing origin validation in WebSockets (Common Weakness Enumeration CWE-1385), permissive cross-domain policy with untrusted domains (CWE-942) and missing authentication for a critical function (CWE-306), and is scored by Google at CVSS 4.0 7.2 (High). Its references include issue 1257 on the project's repository, the finder's report, which describes the same open defaults on the /run_live WebSocket endpoint and the REST API.",
   "reason": "Issue 1257 read on 23 October 2026 with the editor present to approve the fetch (rule 21: the agent run could not open it unattended); the claim now says what the issue reports instead of that it was not read."
  },
  {
   "date": "2026-10-23",
   "field": "fields.Recovery technical",
   "old": "Fixed in version 1.13.0, which per the CVE record enforces a same-origin default for CORS (cross-origin resource sharing) and the /run_live WebSocket endpoint and rejects DNS-rebinding requests over loopback. The v1.13.0 release notes, dated 21 October 2026, list two fixes: allow only same-origin requests by default for CORS and /run_live (commit 5667d38), and reject DNS-rebinding requests that reach the server over loopback (commit 1ae5078); the commits were not opened in this run. For versions 1.6.0 through 1.12.0 the CVE record gives a mitigation: set adk.web.cors.origins to an explicit allowlist of trusted origins.",
   "new": "Fixed in version 1.13.0, which per the CVE record enforces a same-origin default for CORS (cross-origin resource sharing) and the /run_live WebSocket endpoint and rejects DNS-rebinding requests over loopback. The v1.13.0 release notes, dated 21 October 2026, list two fixes: allow only same-origin requests by default for CORS and /run_live (commit 5667d38), and reject DNS-rebinding requests that reach the server over loopback (commit 1ae5078). Both commits were read: the first changes the default of adk.web.cors.origins from * to an empty list, so a UI served from another origin must be listed; the second adds a filter that returns HTTP 403 to a request reaching a loopback-bound server with a Host or Origin that is neither loopback nor a listed origin. For versions 1.6.0 through 1.12.0 the CVE record gives a mitigation: set adk.web.cors.origins to an explicit allowlist of trusted origins.",
   "reason": "The two fix commits named in the release notes were read on 23 October 2026 with the editor present to approve the fetch (rule 21); the claim now states what they change instead of that they were not opened."
  },
  {
   "date": "2026-10-23",
   "field": "status",
   "old": "provisional",
   "new": "confirmed",
   "reason": "The only reason given for provisional status was that the fix commits had not been opened; both were read on 23 October 2026 and confirm the release notes, so the case takes the status of the comparable fixed cases (REG-0027, REG-0037)."
  },
  {
   "date": "2026-10-23",
   "field": "status_text",
   "old": "Provisional (fix commits not opened in this run; no exploitation reported)",
   "new": "Confirmed (fixed in 1.13.0, fix commits read; no exploitation reported)",
   "reason": "Same as the status change."
  },
  {
   "date": "2026-10-23",
   "field": "named_parties[Google].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-23\", \"response\": null}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-23",
 "last_reviewed": "2026-10-23",
 "reviewed_by": null,
 "derived_by": "agent"
}