What happened
NVD published CVE-2026-18236 (CVSS 9.3, Critical) on 2026-07-29, describing a continuation-forgery vulnerability in Google's Agent Development Kit where session-history tampering can forge tool-confirmation responses, bypassing the human-in-the-loop approval gate entirely.
Why it matters
This directly defeats the primary safety control — human confirmation before high-risk tool execution — that agent frameworks rely on to prevent agents from taking destructive or unauthorized actions; it is conceptually the same trust-boundary failure class as the 'GhostApproval' UI-spoofing pattern but attacks the underlying protocol state rather than the display layer, making it a novel agent-execution attack class with framework-wide impact for any ADK-based deployment using tool confirmation.
Attack vector
An attacker able to manipulate or inject events into an agent's session history (e.g., via a compromised upstream tool, prompt injection, or a shared/replayed session store) can forge a tool-confirmation response, causing ADK to execute a sensitive tool call without ever having genuinely obtained human approval — because the framework does not cryptographically bind confirmations to the specific tool-call event they authorize.
Affected systems
google/adk-python (Agent Development Kit) — version prior to fix; see GitHub commit c03f333
Mitigation
Update to the patched adk-python release containing commit c03f333769feaeaa9fe8910fbe95cb9f2d513f54; review any custom session-history persistence for tamper-resistance.