Google Agent Development Kit (ADK) for Java: a web page a developer visits can send messages to the agent running on the local ADK Web development server, triggering its registered tools, and read or delete its sessions, because the server has no authentication and accepted any origin by default; fixed in 1.13.0, CVE (Common Vulnerabilities and Exposures) record published 23 October 2026
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | A developer running an agent locally on ADK Web, the development web server of Google ADK for Java | fact | NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026) | high |
| Mandate: objective | not evidenced in source | assertion | NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026) | low |
| Actor | The locally running agent served by ADK Web, through its /run_live WebSocket endpoint and REST API (com.google.adk:google-adk-dev 0.1.0 before 1.13.0; com.google.adk:google-adk-maven-plugin 0.3.0 before 1.13.0) | fact | NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026) | high |
| Inputs | Messages sent to the agent by a malicious web page the developer visits while the server is running; the requests originate from the developer's browser, so binding the server to localhost does not prevent them | fact | NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026) | high |
| Decision | not evidenced in source | assertion | NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026) | low |
| Envelope: constraints | The server has no authentication. The /run_live WebSocket endpoint accepts connections from any origin by default: hardcoded via setAllowedOrigins("*") in versions 0.1.0 through 1.5.0, and defaulting to * via adk.web.cors.origins in versions 1.6.0 through 1.12.0. Since version 0.4.0 the REST API returns Access-Control-Allow-Origin: * by default. | fact | NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026) | high |
| Action | Per the CVE record, a cross-origin page can send messages to the agent, triggering its registered tools, stream the agent's responses, and list, read, create or delete sessions and artifacts; the record states this as a capability and does not report that it happened | fact | NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026) | high |
| Outcome | State: averted by disclosure. No exploitation reported in the sources read. As of Oct 2026. | assertion | NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026); Release v1.13.0 (google/adk-java), dated 2026-10-21: bug fixes "allow only same-origin requests by default for CORS and /run_live" and "reject DNS-rebinding requests that reach the server over loopback" | medium |
| Evidence: event | CVE-2026-107858, assigned by Google as CVE Numbering Authority, reserved 8 October 2026 and published 23 October 2026; NVD lists it with status Received. It classifies the weaknesses as missing origin validation in WebSockets (Common Weakness Enumeration CWE-1385), permissive cross-domain policy with untrusted domains (CWE-942) and missing authentication for a critical function (CWE-306), and is scored by Google at CVSS 4.0 7.2 (High). Its references include issue 1257 on the project's repository, the finder's report, which describes the same open defaults on the /run_live WebSocket endpoint and the REST API. | fact | NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026); CVE-2026-107858 as reproduced from the CVE List by cve.threatint.com: assigner Google, reserved 2026-10-08, published 2026-10-23, CVSS 4.0 vector, finders' credits; ADK dev web server allows all origins on the /run_live WebSocket and on the REST API, enabling cross-site WebSocket hijacking and cross-origin data theft (issue 1257) | high |
| Recovery: technical | Fixed in version 1.13.0, which per the CVE record enforces a same-origin default for CORS (cross-origin resource sharing) and the /run_live WebSocket endpoint and rejects DNS-rebinding requests over loopback. The v1.13.0 release notes, dated 21 October 2026, list two fixes: allow only same-origin requests by default for CORS and /run_live (commit 5667d38), and reject DNS-rebinding requests that reach the server over loopback (commit 1ae5078). Both commits were read: the first changes the default of adk.web.cors.origins from * to an empty list, so a UI served from another origin must be listed; the second adds a filter that returns HTTP 403 to a request reaching a loopback-bound server with a Host or Origin that is neither loopback nor a listed origin. For versions 1.6.0 through 1.12.0 the CVE record gives a mitigation: set adk.web.cors.origins to an explicit allowlist of trusted origins. | fact | NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026); Release v1.13.0 (google/adk-java), dated 2026-10-21: bug fixes "allow only same-origin requests by default for CORS and /run_live" and "reject DNS-rebinding requests that reach the server over loopback"; fix(dev): allow only same-origin requests by default for CORS and /run_live (commit 5667d38); fix(dev): reject DNS-rebinding requests that reach the server over loopback (commit 1ae5078) | high |
| Recovery: accountability | The CVE record, as reproduced by a CVE-list mirror, credits George Chen (@geo-chen) and Gouri Sankar A (@g0w6y) as finders; the NVD copy does not show the credits | fact | CVE-2026-107858 as reproduced from the CVE List by cve.threatint.com: assigner Google, reserved 2026-10-08, published 2026-10-23, CVSS 4.0 vector, finders' credits | medium |
Controls
| Status | Control | Canonical |
|---|---|---|
| absent | Mechanism: the server accepts messages to the agent from any page in the developer's browser, so a cross-origin page's requests are treated like the developer's own. Why it interrupts: if the server established who was sending a request (authentication, or a same-origin check binding requests to the developer's own UI), the page's messages would be refused before they reached the agent and its tools. Source shows it absent: the CVE record states the server has no authentication and the WebSocket endpoint accepts connections from any origin by default; the 1.13.0 fix is a same-origin default. | C-A1 Actor identity verification |
Inference
inference The CVE record shows that, in its default configuration, any web page the developer opened while ADK Web was running could reach the local agent, because by default the server checked neither who was asking nor where the request came from, and that such a page could make the agent call its registered tools. The record does not say which tools a developer's agent would have, whether any of them asks the developer before running, or that any developer was attacked; per the record, version 1.13.0 enforces a same-origin default and rejects DNS-rebinding requests over loopback.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| NVD-107858 | NVD record CVE-2026-107858 (CNA: Google): missing origin validation in WebSockets and permissive CORS in the ADK Web development server of Google Agent Development Kit for Java, before 1.13.0; CVSS 4.0 7.2 (read through the NVD API, services.nvd.nist.gov, on 23 October 2026) | public record primary record | nvd.nist.gov ↗ checked 2026-10-23 |
| REL-1-13-0 | Release v1.13.0 (google/adk-java), dated 2026-10-21: bug fixes "allow only same-origin requests by default for CORS and /run_live" and "reject DNS-rebinding requests that reach the server over loopback" (interest: vendor describing its own release) | company primary record | github.com ↗ checked 2026-10-23 |
| CVE-COPY | CVE-2026-107858 as reproduced from the CVE List by cve.threatint.com: assigner Google, reserved 2026-10-08, published 2026-10-23, CVSS 4.0 vector, finders' credits (interest: third-party mirror of the CVE Numbering Authority's record; cve.org could not be opened in this run) | public record secondary | cve.threatint.com ↗ checked 2026-10-23 |
| COMMIT-5667 | fix(dev): allow only same-origin requests by default for CORS and /run_live (commit 5667d38) (interest: vendor fix commit in its own repository) | company primary record | github.com ↗ |
| COMMIT-1AE5 | fix(dev): reject DNS-rebinding requests that reach the server over loopback (commit 1ae5078) (interest: vendor fix commit in its own repository) | company primary record | github.com ↗ |
| ISSUE-1257 | ADK dev web server allows all origins on the /run_live WebSocket and on the REST API, enabling cross-site WebSocket hijacking and cross-origin data theft (issue 1257) (interest: the finder's report, cited by the CVE record) | researcher secondary | github.com ↗ |