Answer in brief
CVE-2026-115522 records a Medium severity (CVSS 5.3) vulnerability in Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python. The current sources do not mark it as known exploited. The current feed maps Google/Agent Development Kit (ADK) for Python (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Google/Agent Development Kit (ADK) for Python (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Google/Agent Development Kit (ADK) for Pythongeneric | >=1.19.0 <1.39.1 || >=2.0.0a1 <2.7.0 | 1.39.1, 2.7.0 |
Published upstream
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 28, 2026
Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.
Quoted source text, attributed separately from HOL analysis.