GHSA-X32G-JVVM-4725 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

Impact. Push notification bearer tokens and authentication credentials submitted by clients are written to server log files in cleartext. Any operator, log aggregation system, or attacker with log access can read these secrets and use them to authenticate to the client's push notification...

CVE-2026-111762

The A2A Java SDK (Agent2Agent Protocol) is vulnerable in versions prior to 1.3.0.Final due to improper handling of failed protobuf deserialization in the RestHandler.parseRequestBody method. When JsonFormat.parser().merge() throws an InvalidProtocolBufferException, the application logs the entire...

CVE-2026-111762 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

CVE-2026-111762 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

CVE-2026-59155 Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud...

CVE-2026-59155 Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud...

Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API

Summary The GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials — Cloudflare API tokens, TencentCloud SecretKeys, Slack/Discord/Telegram webhook URLs with embedded bot tokens, and Authorization header values — withou...