{"id":42151,"date":"2026-10-21T00:32:31","date_gmt":"2026-10-20T16:32:31","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-111763"},"modified":"2026-10-21T00:32:31","modified_gmt":"2026-10-20T16:32:31","slug":"cve-2026-111763","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-111763","title":{"rendered":"CVE-2026-111763 &#8211; A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.F"},"content":{"rendered":"<p>A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through `CredentialService`, `AuthInterceptor.intercept` in `client\/transport\/spi\/src\/main\/java\/org\/a2aproject\/sdk\/client\/transport\/spi\/interceptors\/auth\/AuthInterceptor.java` uses `APIKeySecurityScheme.name()` from the remote AgentCard directly as the HTTP header name containing the credential, without checking that the declared location is HEADER. JdkA2AHttpClient uses followRedirects(NORMAL), so an agent-controlled cross-origin redirect forwards the custom credential-bearing header even when the standard Authorization header is stripped. The attack requires configured API key credentials for the agent&#8217;s security scheme and control of the agent&#8217;s AgentCard and redirect response, but no additional client privileges. This issue is fixed in version 1.3.0.Final.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured A<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-42151","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/42151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=42151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=42151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=42151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}