Security Logging Flaw in A2A Java SDK for Agent2Agent Protocol

CVE-2026-111762

What is CVE-2026-111762?

The A2A Java SDK has a vulnerability that occurs in the RestHandler class, where sensitive information is logged in plaintext. When the parser fails during JSON deserialization, particularly due to unknown fields or schema mismatches, server logs reveal authentication credentials and bearer tokens. This leakage allows an attacker with access to logs to exploit these secrets for malicious purposes, such as sending forged updates to push notification endpoints. This issue has been addressed in version 1.3.0.Final, enhancing the SDK’s security.

References