Google ADK dev UI has a perfect 10.0 unauthenticated RCE

Google's Agent Development Kit for Python carries a CVSS 10.0 code injection bug in adk web, the framework's dev UI, covering versions 2.0.0 through 2.6.0, per OffSeq's advisory for CVE-2026-79696. Network vector, no authentication, no user interaction, full compromise of confidentiality, integrity and availability.

adk web is the first command in every ADK tutorial, the thing you run to click around an agent before wiring it into anything real. That means exposed hosts skew toward prototypes somebody spun up on Cloud Run to show a colleague, then forgot about. Nothing alerts on those. Nobody patches what they don't remember deploying.

The bug triggers through a crafted test session replay and fires anywhere pytest is installed, which covers a lot of Cloud Run and GKE deployments. The root cause is an incomplete denylist, CWE-184. Denylists are never complete.

If you've touched ADK, run gcloud run services list across every project you can reach. Check the results for anything running ADK, then do the same sweep across your GKE workloads. Pin past 2.6.0 or pull adk web off any network-reachable surface. A test framework sitting in a production image is worth fixing too while you're in there.

The same day, NVD's entry for CVE-2026-87911 recorded a CVSS 9.6 flaw in AWS's postgres-mcp-server, versions before 1.1.7. Read-only mode never blocked COPY ... TO PROGRAM, so an unauthenticated actor could plant that statement in content the agent processes later and get command execution on the Postgres host.

Two frontier vendors, Google and AWS, same day, same failure mode: a stated safety boundary the code didn't enforce everywhere. "Read-only" in an MCP tool's config is documentation. A database role stripped of pg_execute_server_program, a container with no egress, a filesystem mount that's read-only at the kernel, those are boundaries. The config flag isn't.