You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
bug: agent selector bypass via unvalidated app_name in /run and /run_sse endpoints #4893
In agent_run() and agent_run_sse(), session lookup uses the resolved
app_name but the runner is loaded using raw user-supplied req.app_name.
This allows callers to execute arbitrary agents against any valid session,
bypassing agent-level access control.
The preflight session check in /run_sse is querying against req.app_name, but the runner actually resolves to runner.app_name — so they're hitting different namespace buckets in the session store, which explains the mismatch.
Worth trying: swap line 1682 in adk_web_server.py to use runner.app_name for that get_session call and see if that closes the gap on your end.
If it does fix it, it'd be great to also run it against the /run endpoint and both auto_create_session states before pushing the PR forward — just to make sure there aren't any edge cases hiding in there.
@g0w6y Sorry for the delay on this one!
PR #4924 is in the review queue and definitely hasn't slipped through the cracks.
Given it's a security-class fix with clean test coverage across both endpoints, I'll flag it internally to get some eyes on it sooner. Really appreciate your patience!
at head the runner is built from the request's app_name and the /run_sse preflight reads that same value, so there's no divergence to exploit. closing, open a new issue with a repro on current main and we'll look again.
Activity
surajksharma07 commentedon Mar 20, 2026
The preflight session check in /run_sse is querying against req.app_name, but the runner actually resolves to runner.app_name — so they're hitting different namespace buckets in the session store, which explains the mismatch.
Worth trying: swap line 1682 in adk_web_server.py to use runner.app_name for that get_session call and see if that closes the gap on your end.
If it does fix it, it'd be great to also run it against the /run endpoint and both auto_create_session states before pushing the PR forward — just to make sure there aren't any edge cases hiding in there.
Let us know how it goes!
g0w6y commentedon Mar 21, 2026
@surajksharma07 Done! Swapped line 1682 in adk_web_server.py to use
runner.app_name for the get_session call as you suggested.
Fix is in PR #4924. Tested against both /run and /run_sse with
auto_create_session True and False no edge cases found.
surajksharma07 commentedon Mar 23, 2026
@g0w6y clean test coverage across both endpoints and both session states is exactly the right way to validate this one.
Taking a look at PR #4924 now and will get it moving from our side!
Team is looking more into it.
surajksharma07 commentedon Mar 23, 2026
@wyf7107 Please have a look into it.
surajksharma07 commentedon Mar 31, 2026
@g0w6y Sorry for the delay on this one!
PR #4924 is in the review queue and definitely hasn't slipped through the cracks.
Given it's a security-class fix with clean test coverage across both endpoints, I'll flag it internally to get some eyes on it sooner. Really appreciate your patience!
g0w6y commentedon May 3, 2026
any updates !! @surajksharma07 @wyf7107
g0w6y commentedon Jun 23, 2026
any updates !! @surajksharma07 @wyf7107
GWeale commentedon Aug 6, 2026
at head the runner is built from the request's app_name and the /run_sse preflight reads that same value, so there's no divergence to exploit. closing, open a new issue with a repro on current main and we'll look again.