EUVD-2026-105136

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

CVE-2026-111765 A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

CVE-2026-111765

The A2A Java SDK (official Java SDK for the Agent2Agent Protocol) is vulnerable in versions 1.3.0.Final and prior to 1.3.2.Final . The AndroidA2AHttpClient synchronous POST path improperly overrides the disabled-redirect setting, allowing followRedirects to default to true . This causes the SDK t...

CVE-2026-111765 A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

CVE-2026-111764

The A2A Java SDK (versions prior to 1.3.0.Final ) contains a fail-open default task authorization vulnerability. The InMemoryTaskStore component's no-argument constructor sets the authorizationProvider to null, causing the get(String taskId) method to return tasks without verifying the caller or ...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

EUVD-2026-105130

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-111763 A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through...

EUVD-2026-105127

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through...

CVE-2026-111763 A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through...

CVE-2026-111763

The A2A Java SDK (prior to version 1.3.0.Final ) is vulnerable to credential leakage via HTTP redirects. The AuthInterceptor.intercept component in client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java uses the APIKeySecurityScheme.name(...

CVE-2026-111762 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

EUVD-2026-105044

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

CVE-2026-111762

The A2A Java SDK (Agent2Agent Protocol) is vulnerable in versions prior to 1.3.0.Final due to improper handling of failed protobuf deserialization in the RestHandler.parseRequestBody method. When JsonFormat.parser().merge() throws an InvalidProtocolBufferException, the application logs the entire...

CVE-2026-111762 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

CVE-2026-111761 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

CVE-2026-111761 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

EUVD-2026-105043

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...