CVE-2026-111765
- Source
- https://cve.org/CVERecord?id=CVE-2026-111765
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111765.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-111765
- Aliases
- Related
- Published
- 2026-10-20T15:10:51Z
- Modified
- 2026-10-21T09:36:47Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
- Details
-
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection() with the PostBuilder default followRedirects value of true, leaving a residual of the earlier credential-redirect fix. JSONRPCTransport and RestTransport add interceptor-produced authentication headers and call synchronous post() without disabling redirects. AuthInterceptor permits X-API-Key, API-Key, X-Auth-Token, and X-Authentication headers; Android's repackaged OkHttp strips Authorization on cross-authority redirects but retains these nonstandard headers, disclosing a complete configured API key or token to another authority. The additional exposure applies when redirect or front-door behavior is compromised separately from the credential-handling component, or those components operate in different trust domains; a completely malicious initial origin already receives the credential on the first request. Autonomous clients require no human action, while user-invoked workflows can require interaction. Explicit followRedirects(false) prevents the redirected request. The demonstrated impact is credential disclosure, not subsequent credential use, integrity or availability impact, code execution, or host compromise. This issue is fixed in version 1.3.2.Final.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-522" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111765.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111765.json
- https://github.com/a2aproject/a2a-java/blob/30e31086e24bea096b5f662088661269c9119100/SECURITY.md#L335-L342
- https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e
- https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5
- https://github.com/a2aproject/a2a-java/pull/1141
- https://github.com/a2aproject/a2a-java/releases/tag/v1.3.2.Final
- https://github.com/a2aproject/a2a-java/security/advisories/GHSA-4fpj-g9jf-9rgg
- https://github.com/a2aproject/a2a-java/security/advisories/GHSA-9rhm-2h4x-jwmx
- https://nvd.nist.gov/vuln/detail/CVE-2026-111765
Affected packages
Git / github.com/a2aproject/a2a-java
Affected ranges
- Type
- GIT
- Repo
- https://github.com/a2aproject/a2a-java
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.3.0.Final" }, { "fixed": "1.3.2.Final" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "2a36530d75e11bcf9b81f543464dbe193ca6478e" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "3ae82912a106a6765d7b78042b0ef96e6c2e29b5" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v1.3.2.Final", "range": [ { "fixed": "d4da07e64fc1a20a48224719a38ba8401927dc1f" } ], "source": "REFERENCES_TAG" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111765.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "219171189031750049188923032470881803419",
"length": 2550
},
"id": "CVE-2026-111765-09ab50c5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java",
"function": "asyncRequest"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"233082241354066570813448180093819670417",
"21519454768660744913287845070093521544",
"18030520525811837464370654786568188951",
"289629073483532029468060426450878048712",
"162239936067183603071663074933724620488",
"89111830209238864026470161315079973490",
"169959603564394047366869435914847288247",
"254161678224940017379456498614838482171",
"40335406073137209539280606140796949474",
"284508063442370397363122920376349187820",
"272209893532989451563738884913639550567",
"66762504358454520752952135136815333074",
"274301807992458639323495873826446669001",
"281891372236640844937113543641842568745",
"52917372251392254278158590023034728279"
],
"threshold": 0.9
},
"id": "CVE-2026-111765-17493e20",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "compat-0.3/client/transport/spi/src/main/java/org/a2aproject/sdk/compat03/client/transport/spi/interceptors/auth/AuthInterceptor_v0_3.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "204773715808667608047604044959259281004",
"length": 363
},
"id": "CVE-2026-111765-2153aea9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java",
"function": "VertxA2AHttpClient"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"190876308099512679037918443197519236736",
"144160933694688363382547765301070970662",
"225493822003427586839351171994332203752",
"239560352354722651028959120347820178302",
"337585807637982261768192806754771830941",
"206911232849714040388715472937903947802",
"316580792110581946873857470281069245275",
"182812543732604489279233747690460707521",
"91040172658669801121819772347520874416",
"1075545198676391902019372215048106919",
"299112507834046490542500379518494130976",
"147092611676183227464636137883663696219",
"194799622116183726113803145718839914104",
"182405875434630862249133449391971047943",
"8992000492734226684290204923387605083",
"91040172658669801121819772347520874416",
"1075545198676391902019372215048106919"
],
"threshold": 0.9
},
"id": "CVE-2026-111765-239dfcc4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "145399924160033703551221735275526671294",
"length": 755
},
"id": "CVE-2026-111765-27ca9ea6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "http-client/src/test/java/org/a2aproject/sdk/client/http/JdkA2AHttpClientTest.java",
"function": "testPostDefaultFollowsRedirect"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "19341850345270682614870652988558316461",
"length": 224
},
"id": "CVE-2026-111765-376afe49",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java",
"function": "testBuilderHeaderSetting"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "1195987301821790159022241056572259765",
"length": 1521
},
"id": "CVE-2026-111765-4c93f019",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java",
"function": "intercept"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "312528904333584461332748235057310317033",
"length": 216
},
"id": "CVE-2026-111765-5c9e8dee",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java",
"function": "testBuilderUrlSetting"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "20949775831087824212826406266159733011",
"length": 559
},
"id": "CVE-2026-111765-6dbd2b5d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java",
"function": "createConnection"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "89640935899603841863224742583571727185",
"length": 1453
},
"id": "CVE-2026-111765-7d333dfe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "compat-0.3/client/transport/spi/src/main/java/org/a2aproject/sdk/compat03/client/transport/spi/interceptors/auth/AuthInterceptor_v0_3.java",
"function": "intercept"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295403452416957750108743063401845981058",
"length": 159
},
"id": "CVE-2026-111765-80e3e960",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java",
"function": "JdkA2AHttpClient"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"213399846263700607997461089587486619850",
"179951681752006734857393557547484478251",
"238032432537527031585529865646259450757",
"163826175258965561233135566694255255124",
"141303278248532094255340893852055374909",
"316292319247770312751527653469059242518",
"257729207932247222581873981510446402727",
"283789631220245221678364563894921949974",
"307705946032963547156474381979816280519",
"164009931319422400786233146394541498357",
"45493963487914061500293497790974431734",
"339144871392046260161270840952911794343",
"328844865780091999594186804349095872663",
"78922032674487660298077738372703223721",
"36209194067681507928869605383354485864",
"252854182795845083497897964389003363278",
"124531847405550308635442687868086025217",
"14102334829723983729608608803365146667",
"18363361282130949151568811643382771220",
"148395009149383920287796005846680520809",
"110653229371282134902751324695349416135",
"287249354637766448267362474089423078862",
"151745325648299661666990645679402908252",
"201086275156111334603743356155620869700",
"329215998138531834047548971205512663453",
"205762411649050922372271570313381321133",
"239150048640693532591047479084631782945",
"79935300823819065265900240501419746611",
"39114056514763143012501445969632177521",
"61408529881255340535071761408545256176",
"241741974479514156078265796584052449062",
"220858394643618393248721810924705302778",
"248430572423532256165091994294569774220",
"152831659640430789880862465933754045242",
"315282978905793594207032146173571942114",
"88799228324334628623563396816642347695",
"83702548534771640808890894442051586295",
"325107451934605803102341888081462007682",
"228747478641483191822765390594373146592",
"85263495375182455150995556759922328592",
"19514720673695794684669278167919011963",
"268735869142952698545419352112586345920",
"290135717026761462244038348507324999866",
"236171568201832417557842178106920351688",
"313158082949425275281188126659208751548",
"263657529235772128920454583481498834100",
"48774957638057098857983922910887175733",
"296426346427701886810678109775625735747"
],
"threshold": 0.9
},
"id": "CVE-2026-111765-82ef264f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "55753744802451355982712723027102476360",
"length": 102
},
"id": "CVE-2026-111765-a06615ba",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java",
"function": "testCreateDelete"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"233082241354066570813448180093819670417",
"146613175475215118537251510245469411173",
"15774516481402948509870276336299570947",
"258554781599943596587932212656245720056",
"162239936067183603071663074933724620488",
"114832741494531230118332557450602748253",
"101628560726868638954175422371894642219",
"108433354402844514891494839241727512323",
"111941993224402250006018159098537598176",
"184379370301342803592083431827670690387",
"97806109406974612948671596192975135163",
"76936459604836722745986499886038669367",
"125923826138995043487307218687981243491",
"281891372236640844937113543641842568745",
"52917372251392254278158590023034728279"
],
"threshold": 0.9
},
"id": "CVE-2026-111765-a32a83f7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"126757262861640086018049024661608610743",
"154848449290269486029899532683063293180",
"251084407171788518344138576027514975996",
"30487012813861063774965718225290103530"
],
"threshold": 0.9
},
"id": "CVE-2026-111765-a69b999e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "55753744802451355982712723027102476360",
"length": 102
},
"id": "CVE-2026-111765-a98ab0b8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java",
"function": "testCreateGet"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "55753744802451355982712723027102476360",
"length": 102
},
"id": "CVE-2026-111765-be441256",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java",
"function": "testCreatePost"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "23321515973024461794923956713925120964",
"length": 216
},
"id": "CVE-2026-111765-c20524e4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java",
"function": "testPostBuilderBody"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "136643808420365882585219459631823047475",
"length": 299
},
"id": "CVE-2026-111765-cec80433",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java",
"function": "VertxA2AHttpClient"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"231389643428590296426042642465525084377",
"249363147039955417974880535498988266821",
"61378049150606929969760405115593789989",
"27030440751668402900589919452818964942",
"75618214122361539488447013089492314856",
"124650563769334991951451263407296465881",
"194996251487368916396603178871700639946"
],
"threshold": 0.9
},
"id": "CVE-2026-111765-d08e3c26",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"190876308099512679037918443197519236736",
"144160933694688363382547765301070970662",
"225493822003427586839351171994332203752",
"183912756549587952689511114997472179850",
"140619965956171028544829045994009294916",
"251084407171788518344138576027514975996",
"30487012813861063774965718225290103530",
"43283607287522130710827496291122705096",
"137025187115838383233197475513795204433",
"19439498327041117529365842558517140162",
"323893636633663391358502363111530826596",
"164082289449513199774621672518966731016"
],
"threshold": 0.9
},
"id": "CVE-2026-111765-d51b155b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"245742482994028127038437704544391496528",
"175726866628377098870546532950496783500",
"62342394797753697158268456211128393584",
"226290053579820591136528732899027207021",
"7982189781320667486145143998899980735",
"334107871806073291740050010324385845157",
"124610587703432544458055988641576024832",
"150232944257035412502272587491825079964",
"36174547811865391676333144921840164045",
"288904653404950321425403320164351444579",
"321746948696003236000636836599306757940",
"212653038377898875024045498531386350282"
],
"threshold": 0.9
},
"id": "CVE-2026-111765-d9d903f3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155299682180832588032612490062062615642",
"201325319216391341668983227266725458581",
"93427037518133832964013570325639844341",
"210978438851836314060804588182458286395",
"148687460831853927056049221581449796197",
"64032231061305092852525254820102302185",
"273719364734977194104309003190904281389",
"21545489602158548723775331680268300957",
"331563198584938231557986649328949715227",
"268144503770811296980129332407944020817",
"312453660338691992286523281239832902705",
"138643066134881581826174653917925082579",
"209349225168710373401391139522191740702",
"241588668747149887486518520857556142701",
"209154777742667184093909233198743368108",
"122412890985630319710904067457828202142",
"165184753435675369882798857639271534970",
"153638478100541104794550394461276030105",
"158534794015520075942630568095807670682"
],
"threshold": 0.9
},
"id": "CVE-2026-111765-df23335d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e",
"target": {
"file": "http-client/src/test/java/org/a2aproject/sdk/client/http/JdkA2AHttpClientTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "272045000233190039896904590579289597358",
"length": 69
},
"id": "CVE-2026-111765-e3822a47",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java",
"function": "testNoArgsConstructor"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"245742482994028127038437704544391496528",
"175726866628377098870546532950496783500",
"62342394797753697158268456211128393584",
"226290053579820591136528732899027207021",
"7982189781320667486145143998899980735",
"334107871806073291740050010324385845157",
"236678061425410507686932752132537148327",
"321746948696003236000636836599306757940",
"212653038377898875024045498531386350282",
"107489320168384616519800557603445468162",
"205906788606380793851594242487140587287",
"81391691370227519570143994578278807692",
"320310838678070424341685630952518154430",
"70994952049677248263767337586139194780",
"198852145301591440810657172889748770951",
"131416043116419955642222318338949575776",
"49767537532984505569644151779184337424",
"58032964630230657035139275799470262784",
"88017804841138347317367153280471755421",
"172333003790765443557561189273456525089",
"206604569758061916151280189959702890932",
"93373997931400278073617459532677349542",
"26614988055137727175808576874902067031",
"250018958848620982035713786262275264327",
"159151138745798042924816722269020699736"
],
"threshold": 0.9
},
"id": "CVE-2026-111765-f90d491c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "58424083278079041392992952024131370027",
"length": 261
},
"id": "CVE-2026-111765-fb31bacf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5",
"target": {
"file": "extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java",
"function": "post"
}
}
]
vanir_signatures_modified
"2026-10-21T09:36:47Z"