A2A Java SDK Has A Fail-open Default Task Authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. - Ecosystem: Maven - Affected package: "org.a2aproject.sdk:a2a-java-sdk-server-common"...

A2A Java SDK Has Server-Side Request Forgery (SSRF) In Push-notification Delivery

- Ecosystem: Maven - Affected package: "org.a2aproject.sdk:a2a-java-sdk-server-common" push-notification delivery - Affected versions: "= 1.2.0.Final" and "1.2.1.Final-SNAPSHOT" on "main" prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request...

GHSA-Q78C-5JJQ-57G8 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111761 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111761 Source advisory: OSV:GHSA-Q78C-5JJQ-57G8...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111761 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111761 Source advisory: GHSA-Q78C-5JJQ-57G8...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111764 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111764 Source advisory: GHSA-QW47-MCM5-934W...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111764 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111764 Source advisory: OSV:GHSA-QW47-MCM5-934W...

A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

GHSA-QW47-MCM5-934W A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111764 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111764 Source advisory: MEND:CVE-2026-111764...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-111761 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-111761 Source advisory: MEND:CVE-2026-111761...

PT-2026-120318

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

PT-2026-120320

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

io.agntcy.slim:slim-a2a-java (>=0.1.1, <=0.4.2), io.github.sh1bari:a2a-spring-boot-server-autoconfigure (>=0.1.0, <=0.1.2) +50 more potentially affected by CVE-2026-90820 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.1.0.final, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.1.0.final, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.2.0.fina...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +73 more potentially affected by CVE-2026-90819 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-90819 Source advisory: MEND:CVE-2026-90819...

ai.koog:agents-mcp-server (>=0.4.3-dev-22092025-feat-828, <=1.3.0-beta), io.modelcontextprotocol:kotlin-sdk (>=0.7.0, <=0.12.0) +1 more potentially affected by CVE-2026-53937 via io.modelcontextprotocol:kotlin-sdk-server (>=0.7.0, <=0.12.0)

io.modelcontextprotocol:kotlin-sdk-server MAVEN version =0.7.0, =0.4.3-dev-22092025-feat-828, =0.7.0, =0.12.0 - org.litote.mastodon.ktor.sdk:mcp-server 0.2.0 Source cves: CVE-2026-53937 Source advisory: MEND:CVE-2026-53937...

com.digitalpetri.opcua:uanodeset-namespace (>=0.3, <=0.4.1), net.rossonet.waldot:waldot-client (0.6.1) +15 more potentially affected by CVE-2026-63248 via org.eclipse.milo:milo-sdk-server (>=1.0.0, <=1.1.4)

org.eclipse.milo:milo-sdk-server MAVEN version =1.0.0, =0.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.4.4, =4.18.1, =3.31.0, =3.31.0, =3.31.0, =4.16.0, =4.16.0, =1.0.1, =1.1.4 and more Source cves: CVE-2026-63248 Source advisory: MEND:CVE-2026-63248...

com.digitalpetri.opcua:uanodeset-namespace (>=0.3, <=0.4.1), net.rossonet.waldot:waldot-client (0.6.1) +15 more potentially affected by CVE-2026-58080 via org.eclipse.milo:milo-sdk-server (>=1.0.0, <=1.1.4)

org.eclipse.milo:milo-sdk-server MAVEN version =1.0.0, =0.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.4.4, =4.18.1, =3.31.0, =3.31.0, =3.31.0, =4.16.0, =4.16.0, =1.0.1, =1.1.4 and more Source cves: CVE-2026-58080 Source advisory: MEND:CVE-2026-58080...

com.digitalpetri.opcua:uanodeset-namespace (>=0.3, <=0.4.1), net.rossonet.waldot:waldot-client (0.6.1) +15 more potentially affected by CVE-2026-62927 via org.eclipse.milo:milo-sdk-server (>=1.0.0, <=1.1.4)

org.eclipse.milo:milo-sdk-server MAVEN version =1.0.0, =0.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.4.4, =4.18.1, =3.31.0, =3.31.0, =3.31.0, =4.16.0, =4.16.0, =1.0.1, =1.1.4 and more Source cves: CVE-2026-62927 Source advisory: MEND:CVE-2026-62927...