---
id: CVE-2026-111763
title: >-
  A2A Java SDK send client credentials under server-controlled HTTP header name,
  enabling leakage via redirect
summary: >-
  A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol.
  Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the
  default JDK-based client to forward a configured API key to a third-party
  server. When …
severity: medium
cvss: 5.7
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-522
vendor: a2aproject
product: a2a-java
affected:
  - a2a-java < 1.3.0.Final
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T15:03:28.034Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111763'
references:
  - url: >-
      https://github.com/a2aproject/a2a-java/security/advisories/GHSA-9rhm-2h4x-jwmx
    label: >-
      https://github.com/a2aproject/a2a-java/security/advisories/GHSA-9rhm-2h4x-jwmx
  - url: >-
      https://github.com/a2aproject/a2a-java/security/advisories/GHSA-4fpj-g9jf-9rgg
    label: >-
      https://github.com/a2aproject/a2a-java/security/advisories/GHSA-4fpj-g9jf-9rgg
  - url: 'https://github.com/a2aproject/a2a-java/pull/1097'
    label: 'https://github.com/a2aproject/a2a-java/pull/1097'
  - url: >-
      https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e
    label: >-
      https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e
  - url: 'https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final'
    label: 'https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final'
tags:
  - cve.org
ingestedAt: '2026-10-20T16:10:53.335Z'
---

## Overview

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through `CredentialService`, `AuthInterceptor.intercept` in `client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java` uses `APIKeySecurityScheme.name()` from the remote AgentCard directly as the HTTP header name containing the credential, without checking that the declared location is HEADER. JdkA2AHttpClient uses followRedirects(NORMAL), so an agent-controlled cross-origin redirect forwards the custom credential-bearing header even when the standard Authorization header is stripped. The attack requires configured API key credentials for the agent's security scheme and control of the agent's AgentCard and redirect response, but no additional client privileges. This issue is fixed in version 1.3.0.Final.

## Affected

- `a2a-java < 1.3.0.Final`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.