Credential Disclosure Issue in A2A Java SDK by A2A

CVE-2026-111765

What is CVE-2026-111765?

The A2A Java SDK presents a fault where the synchronous POST path in AndroidA2AHttpClient overrides the disabled-redirect setting, exposing sensitive authentication headers. Specifically, headers such as X-API-Key, API-Key, X-Auth-Token, and X-Authentication are exposed during cross-authority redirects, which could potentially compromise confidential credentials. This vulnerability can be exploited through both autonomous clients and user-initiated workflows, facilitating unauthorized access to credentials without subsequent integrity or availability impacts. The issue has been rectified in version 1.3.2.Final.

References