Agent Development Kit (ADK) Path Traversal Vulnerability (CVE-2026-79707)
A public exploit has been published for a path traversal vulnerability in the Agent Development Kit (ADK) Dev UI builder endpoint, enabling arbitrary file read.
CVE search metadata
CVE search record: CVE-2026-79707. EPSS: 0.67%. KEV: no. Product: Agent Development Kit (ADK). Brief: Agent Development Kit (ADK) Path Traversal Vulnerability (CVE-2026-79707). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-79707/
Triage facts
Revision 1- Applicability
- Agent Development Kit (ADK)
- Evidence
- Not observed
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 12, 17:43 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
The Agent Development Kit (ADK) Dev UI builder endpoint is affected by a path traversal vulnerability (CVE-2026-79707) that allows for arbitrary file reading. A public proof-of-concept exploit script is currently available, which specifically targets this endpoint to retrieve files, such as .env files.
Impact
Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the host system, which may result in the exposure of sensitive data.
Recommendation
Organizations should review their infrastructure to identify instances of the Agent Development Kit (ADK) and monitor logs for unauthorized access patterns targeting the builder endpoint.
Detection coverage 1
Detect CVE-2026-79707 Potential Path Traversal
highDetects URI-encoded or standard path traversal sequences targeting the ADK builder endpoint.
Detection queries are available on the platform. Get full rules →