Read the docs
TI-2026-76903 Aliases CVE-2026-111763GHSA-9rhm-2h4x-jwmx

A2A Java SDK sends API keys to third-party servers via redirects

Priority LOW 25CWE-522Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-522.

Summary

The A2A Java SDK from 0 before 1.3.0.Final (Maven org.a2aproject.sdk:a2a-java-sdk-parent) uses the header name from a remote agent's AgentCard to carry the configured API key without checking its declared location. This is an insufficiently protected credentials flaw (CWE-522). A malicious or compromised remote agent can use a cross-origin redirect to forward the API key to a third-party server.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through `CredentialService`, `AuthInterceptor.intercept` in `client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java` uses `APIKeySecurityScheme.name()` from the remote AgentCard directly as the HTTP header name containing the credential, without checking that the declared location is HEADER. JdkA2AHttpClient uses followRedirects(NORMAL), so an agent-controlled cross-origin redirect forwards the custom credential-bearing header even when the standard Authorization header is stripped. The attack requires configured API key credentials for the agent's security scheme and control of the agent's AgentCard and redirect response, but no additional client privileges. This issue is fixed in version 1.3.0.Final.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00141 3rd percentileScored 2026-11-07
Fix Fixed a2a-java (a2aproject): 1.3.0.Finalorg.a2aproject.sdk:a2a-java-sdk-parent (Maven): 1.3.0.Final

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
a2aprojecta2a-javabefore 1.3.0.Final1.3.0.FinalPatch availableCNA
—org.a2aproject.sdk:a2a-java-sdk-parent (Maven)before 1.3.0.Final1.3.0.FinalPatch availableGHSA-9rhm-2h4x-jwmx
  • a2a-java Vendora2aproject Affected before 1.3.0.Final Fixed in 1.3.0.Final Patch available CNA
  • org.a2aproject.sdk:a2a-java-sdk-parent (Maven) Vendor— Affected before 1.3.0.Final Fixed in 1.3.0.Final Patch available GHSA-9rhm-2h4x-jwmx

Remediation

Upgrade the Maven package org.a2aproject.sdk:a2a-java-sdk-parent to 1.3.0.Final. The sources list no fixed version for a2a-java.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA a2a-java (a2aproject) Fixed in 1.3.0.Final
  • Fix · GHSA-9rhm-2h4x-jwmx org.a2aproject.sdk:a2a-java-sdk-parent (Maven) Fixed in 1.3.0.Final Advisory →

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-111763
  2. 2026-10-21 Alias added: GHSA-9rhm-2h4x-jwmx
  3. 2026-10-21 Fix available: Maven/org.a2aproject.sdk:[email protected] · GHSA-9rhm-2h4x-jwmx
  4. 2026-10-21 CVSS score added · GHSA-9rhm-2h4x-jwmx
  5. 2026-10-21 Weakness changed · GHSA-9rhm-2h4x-jwmx
  6. 2026-10-21 7 new references · GHSA-9rhm-2h4x-jwmx
  7. 2026-10-21 CISA SSVC decision points changed
  8. 2026-10-21 Priority changed: MEDIUM → LOW

References

Advisory 1

Other 6

  • TI-2026-76905 Android A2A Java SDK forwards API keys across redirects CVSS 3.1HIGH 7.5
  • TI-2026-76904 A2A Java SDK default task store skips authorization on task reads CVSS 3.1HIGH 7.5
  • TI-2026-76847 Server-side request forgery in A2A Java SDK push notifications CVSS 3.1MEDIUM 5.8
  • TI-2026-81183 Resource consumption in a2aproject a2a-go REST SSE handler CVSS 4.0MEDIUM 6.9
  • TI-2026-61722 HTTP response splitting in a2aproject a2a-java CVSS 4.0MEDIUM 6.9
  • TI-2026-81185 Denial of service in a2aproject a2a-go Distributed Manager Cancel CVSS 4.0MEDIUM 6.9
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences