CVE-2026-111763 json
A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect
published 2026-10-20 19 d ago modified 2026-10-21 18 d ago also GHSA-9rhm-2h4x-jwmx , EUVD-2026-105127
- cvss
- 5.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 3%
- public exploits
- 0
- none known
Summary
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through `CredentialService`, `AuthInterceptor.intercept` in `client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java` uses `APIKeySecurityScheme.name()` from the remote AgentCard directly as the HTTP header name containing the credential, without checking that the declared location is HEADER. JdkA2AHttpClient uses followRedirects(NORMAL), so an agent-controlled cross-origin redirect forwards the custom credential-bearing header even when the standard Authorization header is stripped. The attack requires configured API key credentials for the agent's security scheme and control of the agent's AgentCard and redirect response, but no additional client privileges. This issue is fixed in version 1.3.0.Final.
Patch / fix
- maven org.a2aproject.sdk:a2a-java-sdk-parent 1.3.0.Final
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 d ago
Exploit prediction
0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.7 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.7 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.a2aproject.sdk:a2a-java-sdk-parent | <1.3.0.Final |
1.3.0.Final |
Affected products
- a2aproject a2a-java
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
References
-
github.com
/a2aproject/a2a-java/pull/1097
web
-
github.com
/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e
web
-
github.com
/a2aproject/a2a-java/security/advisories/GHSA-9rhm-2h4x-jwmx
web
-
github.com
/a2aproject/a2a-java/security/advisories/GHSA-4fpj-g9jf-9rgg
web
-
github.com
/a2aproject/a2a-java/releases/tag/v1.3.0.Final
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-111763
advisory
-
github.com
/a2aproject/a2a-java
package
Sources
- CVE List CVE-2026-111763
- GitHub Advisory GHSA-9rhm-2h4x-jwmx
- NVD CVE-2026-111763
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.