Java SDK Vulnerability in A2A Protocol by A2A Project
CVE-2026-111761

5.8MEDIUM

Key Information:

Vendor

A2aproject

Status
A2a-java
Vendor
CVE Published:
20 October 2026

What is CVE-2026-111761?

The A2A Java SDK, utilized for the Agent2Agent Protocol, has a serious vulnerability prior to version 1.3.0.Final. The BasePushNotificationSender component sends task data directly to a specified URL without rigorous validation, potentially exposing systems to unauthorized access and manipulation. Attackers can exploit this flaw by registering malicious destinations, leading to unauthorized requests being sent from the server's network to various sensitive endpoints. Moreover, the handling of redirects without proper checks allows attackers to easily bypass destination validation, further compromising the system's integrity. This vulnerability is particularly concerning as it does not require user credentials or interaction, making it accessible to malicious entities. The issue is resolved in version 1.3.0.Final.

Affected Version(s)

a2a-java < 1.3.0.Final

References

https://github.com/a2aproject/a2a-java/security/advisorie...
x_refsource_CONFIRM
https://github.com/a2aproject/a2a-java/pull/1096
x_refsource_MISC
https://github.com/a2aproject/a2a-java/commit/b855b2ae37e...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.