CVE-2026-115522
Description
A flaw was found in the FileArtifactService component of Google Agent Development Kit (ADK). The service fails to isolate stored files by application name when constructing directory paths on disk. This issue allows a user in one application to access, overwrite, or delete stored files belonging to another application when both applications share the same storage root and use identical user or session identifiers.
Statement
This vulnerability is rated as Moderate impact because exploitation requires low-privileged authenticated access and depends on multiple distinct applications sharing both a common artifact storage directory and identical session or user identifiers. Within Red Hat OpenShift Lightspeed and Insights agent environments, agentic sandbox components relying on the Google Agent Development Kit may allow an authenticated caller to access or modify artifacts across application boundaries if these conditions are met. However, the flaw does not grant system-level administrative privileges or lead to broader cluster compromise.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
