Insecure Task Read Configuration in A2A Java SDK by A2A Project

CVE-2026-111764

What is CVE-2026-111764?

The A2A Java SDK contains a vulnerability within the InMemoryTaskStore configuration, where the lack of authorization checks allows unauthorized users to read tasks. This issue arises as the default setup does not provide an authorization mechanism, leaving sensitive data exposed. Without adequate authorization through a TaskAuthorizationProvider and the necessary AuthorizationRequestHandlerDecorator, attackers can exploit this flaw in a multi-caller environment to access task statuses, context IDs, message histories, and artifacts simply by knowing or guessing a legitimate task ID. Moreover, the default endpoint configurations do not mandate authentication, permitting unprivileged users to access sensitive task information. This vulnerability is addressed in version 1.3.0.Final.

References