CVE-2026-111765

Awaiting Analysis Awaiting Analysis - Queue

A2A Java SDK Credential Disclosure via Redirect

Publication date: 2026-10-20

Last updated on: 2026-10-22

Assigner: GitHub, Inc.

Description

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection() with the PostBuilder default followRedirects value of true, leaving a residual of the earlier credential-redirect fix. JSONRPCTransport and RestTransport add interceptor-produced authentication headers and call synchronous post() without disabling redirects. AuthInterceptor permits X-API-Key, API-Key, X-Auth-Token, and X-Authentication headers; Android's repackaged OkHttp strips Authorization on cross-authority redirects but retains these nonstandard headers, disclosing a complete configured API key or token to another authority. The additional exposure applies when redirect or front-door behavior is compromised separately from the credential-handling component, or those components operate in different trust domains; a completely malicious initial origin already receives the credential on the first request. Autonomous clients require no human action, while user-invoked workflows can require interaction. Explicit followRedirects(false) prevents the redirected request. The demonstrated impact is credential disclosure, not subsequent credential use, integrity or availability impact, code execution, or host compromise. This issue is fixed in version 1.3.2.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-22

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-111765

EUVD

EUVD-2026-105136

Affected Vendors & Products

Vendor	Product	Version / Range
a2aproject	a2a-java	>= 1.3.0.Final, < 1.3.2.Final

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

CVE-2026-111765 is a vulnerability in the A2A Java SDK's Android HTTP client where synchronous POST requests override a security fix that disabled automatic HTTP redirects. This allows credentials like API keys or tokens to be forwarded to unintended authorities during redirects, potentially exposing them to malicious destinations.

Detection Guidance

To detect this vulnerability, inspect your A2A Java SDK version. If using versions 1.3.0.Final to 1.3.1.Final of the org.a2aproject.sdk:a2a-java-sdk-http-client-android package, the system is vulnerable. Check HTTP client configurations for automatic redirect handling enabled by default.

Impact Analysis

The vulnerability could lead to unauthorized disclosure of credentials to different authorities without user interaction. While it does not enable code execution or host compromise, it risks exposing API keys or tokens to malicious redirect destinations during cross-origin redirects.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of API keys or tokens during HTTP redirects, which may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information). Unauthorized credential exposure risks unauthorized access to sensitive data, potentially resulting in compliance breaches.

Mitigation Strategies

Upgrade to A2A Java SDK version 1.3.2.Final or later. Explicitly set followRedirects(false) in PostBuilder configurations. Validate HTTP client implementations to ensure redirects are disabled by default.

Hi! I’m here to help you understand CVE-2026-111765. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...