CVE-2026-111761
Received Received - Intake

Server-Side Request Forgery in A2A Java SDK

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects. InMemoryPushNotificationConfigStore.setInfo stores the URL verbatim, and onCreateTaskPushNotificationConfig does not validate the destination. In the default deployment with push notifications enabled, an unauthenticated caller can register a destination through an inline SendMessage configuration or CreateTaskPushNotificationConfig for an existing task, causing task status and artifact updates to send requests from the server's network position to loopback, private, link-local cloud-metadata, IPv6 unique-local, unspecified, or multicast destinations where routing permits. JdkA2AHttpClient and VertxA2AHttpClient follow redirects, allowing a webhook redirect to bypass creation-time destination checks and convert a POST into a GET; hostname-only checks also do not prevent DNS rebinding. Direct POST delivery can push attacker-influenced task data into internal services, whereas a redirected POST-to-GET request drops the body. The sender discards the fetched response and does not expose delivery success or failure, so the demonstrated behavior does not provide response read-back. No credentials or user interaction are required. This issue is fixed in version 1.3.0.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-111761
EUVD
EUVD-2026-105043

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
a2aproject a2a-java < 1.3.0.Final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111761 is a Server-Side Request Forgery (SSRF) vulnerability in the A2A Java SDK's push notification functionality. It allows unauthenticated attackers to force the server into making HTTP requests to arbitrary internal or cloud-metadata endpoints without credentials or user interaction. The issue stems from lack of URL validation in BasePushNotificationSender, which sends task data to unchecked URLs. HTTP clients follow redirects by default, enabling DNS rebinding attacks to bypass restrictions.

Detection Guidance

To detect this SSRF vulnerability, monitor outbound HTTP/HTTPS requests from your A2A Java SDK server to unexpected destinations like loopback, private, or metadata endpoints. Check server logs for POST requests to unusual URLs or redirects that bypass validation. Use network monitoring tools to identify requests to RFC1918, link-local, or cloud-metadata addresses.

Impact Analysis

An attacker could exploit this to access internal services, push malicious task data into private networks, or bypass security controls via DNS rebinding. The server may send requests to loopback, private, or metadata addresses, potentially leaking sensitive data or enabling further attacks. No credentials are required, and exploitation does not depend on user interaction.

Compliance Impact

This SSRF vulnerability could lead to unauthorized network access, data exfiltration, or integrity breaches, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive data. Organizations using affected versions may face compliance risks due to insufficient network access controls.

Mitigation Strategies
  • Upgrade to A2A Java SDK version 1.3.0.Final or later to apply the fix.
  • Disable push notifications via the new configuration option `a2a.push-notifications.enabled` if not required.
  • Implement network-layer egress filtering to block outbound traffic to metadata endpoints and internal ranges until patched.
  • Review and restrict HTTP client configurations to disable redirect following and enforce strict URL validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111761. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart