{"id":42115,"date":"2026-10-21T00:32:25","date_gmt":"2026-10-20T16:32:25","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-111762"},"modified":"2026-10-21T00:32:25","modified_gmt":"2026-10-20T16:32:25","slug":"cve-2026-111762","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-111762","title":{"rendered":"CVE-2026-111762 &#8211; A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.F"},"content":{"rendered":"<p>A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in `transport\/rest\/src\/main\/java\/org\/a2aproject\/sdk\/transport\/rest\/handler\/RestHandler.java` logs the entire JSON request body at SEVERE level when JsonFormat.parser().merge() throws InvalidProtocolBufferException. With push notifications enabled, createTaskPushNotificationConfiguration reaches this parser for requests to `\/v1\/tenants\/{tenant}\/tasks\/{taskId}\/pushNotificationConfigs`, whose token and authentication.credentials fields can contain bearer tokens and authentication credentials for client push endpoints. A valid JSON body that fails protobuf deserialization, including an unknown field under strict parsing or a schema mismatch, causes those secrets to be written to the server logs in cleartext. An attacker with access to the server logs or a log aggregation system can retrieve the credentials and potentially use the credentials to send forged task status updates to the client&#8217;s push notification endpoint. This issue is fixed in version 1.3.0.Final.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in `transport\/rest\/src\/main\/java\/org\/a2aproject\/sdk\/transport\/rest\/handler\/<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-42115","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/42115","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=42115"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=42115"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=42115"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}