CyberRota Analysis
AI-GeneratedA vulnerability in the Agent Development Kit (ADK) enables attackers to forge tool confirmation responses, allowing unauthorized execution of tools by manipulating session history. The lack of verification for tool registration and confirmation requirements poses a significant risk to systems utilizing this framework. Organizations leveraging the ADK should prioritize addressing this vulnerability to prevent potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework did not verify if the target tool was registered to the executing agent, did not validate if the tool actually required confirmation, and did not match the confirmation arguments against the original tool call event in the history.