CVE-2026-111763

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111763
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111763.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111763
Aliases
Related
GHSA (2)
Published
2026-10-20T15:03:28Z
Modified
2026-10-21T09:36:47Z
Severity
  • 5.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect
Details

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through CredentialService, AuthInterceptor.intercept in client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java uses APIKeySecurityScheme.name() from the remote AgentCard directly as the HTTP header name containing the credential, without checking that the declared location is HEADER. JdkA2AHttpClient uses followRedirects(NORMAL), so an agent-controlled cross-origin redirect forwards the custom credential-bearing header even when the standard Authorization header is stripped. The attack requires configured API key credentials for the agent's security scheme and control of the agent's AgentCard and redirect response, but no additional client privileges. This issue is fixed in version 1.3.0.Final.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-522"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111763.json"
}
References

Affected packages

Git / github.com/a2aproject/a2a-java

Affected ranges

Type
GIT
Repo
https://github.com/a2aproject/a2a-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
43bde91e3319f0a92db3ac2104215dcdbbb77679
Fixed
2a36530d75e11bcf9b81f543464dbe193ca6478e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.3.0.Final"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "2a36530d75e11bcf9b81f543464dbe193ca6478e"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.3.0.Final",
            "range":  [
                {
                    "fixed":  "43bde91e3319f0a92db3ac2104215dcdbbb77679"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.2.3
0.2.5
0.2.5.Beta2
1.*
1.0.0.Beta1
Other
nightly-metrics
v0.*
v0.3.0.Alpha1
v0.3.0.Beta1
v0.3.0.Beta2
v0.3.0.Final
v1.*
v1.0.0.Alpha1
v1.0.0.Alpha2
v1.0.0.Alpha3
v1.0.0.Alpha4
v1.0.0.CR1
v1.0.0.Final
v1.1.0.Final
v1.2.0.Final

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111763.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "233082241354066570813448180093819670417",
                "21519454768660744913287845070093521544",
                "18030520525811837464370654786568188951",
                "289629073483532029468060426450878048712",
                "162239936067183603071663074933724620488",
                "89111830209238864026470161315079973490",
                "169959603564394047366869435914847288247",
                "254161678224940017379456498614838482171",
                "40335406073137209539280606140796949474",
                "284508063442370397363122920376349187820",
                "272209893532989451563738884913639550567",
                "66762504358454520752952135136815333074",
                "274301807992458639323495873826446669001",
                "281891372236640844937113543641842568745",
                "52917372251392254278158590023034728279"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111763-17493e20",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "compat-0.3/client/transport/spi/src/main/java/org/a2aproject/sdk/compat03/client/transport/spi/interceptors/auth/AuthInterceptor_v0_3.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "204773715808667608047604044959259281004",
            "length":  363
        },
        "id":  "CVE-2026-111763-2153aea9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java",
            "function":  "VertxA2AHttpClient"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "190876308099512679037918443197519236736",
                "144160933694688363382547765301070970662",
                "225493822003427586839351171994332203752",
                "239560352354722651028959120347820178302",
                "337585807637982261768192806754771830941",
                "206911232849714040388715472937903947802",
                "316580792110581946873857470281069245275",
                "182812543732604489279233747690460707521",
                "91040172658669801121819772347520874416",
                "1075545198676391902019372215048106919",
                "299112507834046490542500379518494130976",
                "147092611676183227464636137883663696219",
                "194799622116183726113803145718839914104",
                "182405875434630862249133449391971047943",
                "8992000492734226684290204923387605083",
                "91040172658669801121819772347520874416",
                "1075545198676391902019372215048106919"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111763-239dfcc4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "145399924160033703551221735275526671294",
            "length":  755
        },
        "id":  "CVE-2026-111763-27ca9ea6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "http-client/src/test/java/org/a2aproject/sdk/client/http/JdkA2AHttpClientTest.java",
            "function":  "testPostDefaultFollowsRedirect"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "1195987301821790159022241056572259765",
            "length":  1521
        },
        "id":  "CVE-2026-111763-4c93f019",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java",
            "function":  "intercept"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "20949775831087824212826406266159733011",
            "length":  559
        },
        "id":  "CVE-2026-111763-6dbd2b5d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java",
            "function":  "createConnection"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "89640935899603841863224742583571727185",
            "length":  1453
        },
        "id":  "CVE-2026-111763-7d333dfe",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "compat-0.3/client/transport/spi/src/main/java/org/a2aproject/sdk/compat03/client/transport/spi/interceptors/auth/AuthInterceptor_v0_3.java",
            "function":  "intercept"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "295403452416957750108743063401845981058",
            "length":  159
        },
        "id":  "CVE-2026-111763-80e3e960",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java",
            "function":  "JdkA2AHttpClient"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "233082241354066570813448180093819670417",
                "146613175475215118537251510245469411173",
                "15774516481402948509870276336299570947",
                "258554781599943596587932212656245720056",
                "162239936067183603071663074933724620488",
                "114832741494531230118332557450602748253",
                "101628560726868638954175422371894642219",
                "108433354402844514891494839241727512323",
                "111941993224402250006018159098537598176",
                "184379370301342803592083431827670690387",
                "97806109406974612948671596192975135163",
                "76936459604836722745986499886038669367",
                "125923826138995043487307218687981243491",
                "281891372236640844937113543641842568745",
                "52917372251392254278158590023034728279"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111763-a32a83f7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "136643808420365882585219459631823047475",
            "length":  299
        },
        "id":  "CVE-2026-111763-cec80433",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java",
            "function":  "VertxA2AHttpClient"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "231389643428590296426042642465525084377",
                "249363147039955417974880535498988266821",
                "61378049150606929969760405115593789989",
                "27030440751668402900589919452818964942",
                "75618214122361539488447013089492314856",
                "124650563769334991951451263407296465881",
                "194996251487368916396603178871700639946"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111763-d08e3c26",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "245742482994028127038437704544391496528",
                "175726866628377098870546532950496783500",
                "62342394797753697158268456211128393584",
                "226290053579820591136528732899027207021",
                "7982189781320667486145143998899980735",
                "334107871806073291740050010324385845157",
                "124610587703432544458055988641576024832",
                "150232944257035412502272587491825079964",
                "36174547811865391676333144921840164045",
                "288904653404950321425403320164351444579",
                "321746948696003236000636836599306757940",
                "212653038377898875024045498531386350282"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111763-d9d903f3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "155299682180832588032612490062062615642",
                "201325319216391341668983227266725458581",
                "93427037518133832964013570325639844341",
                "210978438851836314060804588182458286395",
                "148687460831853927056049221581449796197",
                "64032231061305092852525254820102302185",
                "273719364734977194104309003190904281389",
                "21545489602158548723775331680268300957",
                "331563198584938231557986649328949715227",
                "268144503770811296980129332407944020817",
                "312453660338691992286523281239832902705",
                "138643066134881581826174653917925082579",
                "209349225168710373401391139522191740702",
                "241588668747149887486518520857556142701",
                "209154777742667184093909233198743368108",
                "122412890985630319710904067457828202142",
                "165184753435675369882798857639271534970",
                "153638478100541104794550394461276030105",
                "158534794015520075942630568095807670682"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111763-df23335d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
        "target":  {
            "file":  "http-client/src/test/java/org/a2aproject/sdk/client/http/JdkA2AHttpClientTest.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T09:36:47Z"