Google ADK is susceptible to a critical authorization flaw that allows attackers to forge tool confirmations and execute unauthorized tools.

This vulnerability involves incorrect authorization where the framework fails to validate tool registration and confirmation requirements, allowing an unauthenticated attacker to inject events and forge confirmation responses.

The vulnerability allows for unauthorized tool execution, which could be leveraged to perform malicious actions within the context of an agent. With a CVSS score of 9.3, this represents a significant risk to the integrity and availability of automated agent workflows and the data they process.

Immediate Action: Update Google ADK to version 2.5.0 or later to ensure proper validation of tool confirmation responses.

Proactive Monitoring: Audit session history logs for signs of injected events or unexpected tool execution patterns.

Compensating Controls: Apply input validation routines at the application layer to ensure that only authorized tool calls are processed by the agent framework.

Public Exploit Available: Unknown

Security teams should immediately update the Google ADK library to version 2.5.0 to mitigate the risk of unauthorized tool execution. Verification of the implementation should follow to ensure that all agent interactions are properly authenticated and validated against the session history.