A2A Java SDK Has A Fail-open Default Task Authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. - Ecosystem: Maven - Affected package: "org.a2aproject.sdk:a2a-java-sdk-server-common"...

EUVD-2026-106878

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/taskstore/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as...

CVE-2026-113707

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/taskstore/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as...

CVE-2026-113707 a2aproject a2a-rs inmemory.rs update race condition

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/taskstore/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as...

CVE-2026-113707

A security flaw was identified in a2aproject a2a-rs up to version 0.4.4 . The vulnerability exists within the InMemoryTaskStore::update function located in the file a2a-server/src/task_store/inmemory.rs, where a race condition can occur. This flaw may be exploited via a remote attack vector. To r...

CVE-2026-113707 a2aproject a2a-rs inmemory.rs update race condition

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/taskstore/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as...

CVE-2026-113707

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/taskstore/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as...

CVE-2026-113707 a2aproject a2a-rs inmemory.rs update race condition

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/taskstore/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as...

A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

GHSA-QW47-MCM5-934W A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

Missing Authorization

Overview @modelcontextprotocol/sdk is a Model Context Protocol implementation for TypeScript Affected versions of this package are vulnerable to Missing Authorization via the InMemoryTaskStore implementation, where tasks created within one session are accessible to requests from other sessions. A...

CVE-2026-111764

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

Agent2Agent A2A Rust SDK race condition vulnerability

The Agent2Agent A2A Rust SDK versions 0.4.0, 0.4.1, 0.4.2, 0.4.3, and 0.4.4 have a race condition vulnerability. This vulnerability stems from improper handling of the InMemoryTaskStore::update function in the file a2a-server/src/taskstore/inmemory.rs. It may lead to race conditions, and remote...

CVE-2026-111764

The A2A Java SDK (versions prior to 1.3.0.Final ) contains a fail-open default task authorization vulnerability. The InMemoryTaskStore component's no-argument constructor sets the authorizationProvider to null, causing the get(String taskId) method to return tasks without verifying the caller or ...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-111764

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

EUVD-2026-105130

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

PT-2026-120290

Summary In affected versions, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned...