{"id":"CVE-2026-111763","kind":"vulnerability","aliases":["CVE-2026-111763","GHSA-9rhm-2h4x-jwmx"],"related":[],"title":"A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect","description":"*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an `APIKeySecurityScheme` specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows the redirect and forwards the custom header containing the credential, since only the standard `Authorization` header may be stripped on cross-origin redirects.\n\n**Where.** `client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java:69` in `intercept`\n\n**What.** The `apiKeySecurityScheme.name()` field from the remote agent's AgentCard (untrusted, server-controlled data) is used directly as the HTTP header name when placing client credentials. Combined with `JdkA2AHttpClient`'s `followRedirects(NORMAL)` policy, credentials under custom header names survive cross-origin redirects (only `Authorization` is stripped on newer JDKs), allowing a malicious agent to leak client credentials to third-party servers. Additionally, `AuthInterceptor` does not check that `location==HEADER` before placing the credential as a header.\n\n**Exploit scenario.** Client configures an API key credential for agent's security scheme `myAuth`. The malicious agent returns an AgentCard where `securitySchemes` includes `myAuth` as `APIKeySecurityScheme` with `name='X-Leaked-Cred'` and `location=HEADER`. `AuthInterceptor` places the credential in the `X-Leaked-Cred` header. The agent responds with HTTP 302 redirect to `https://evil.com/collect`. `JdkA2AHttpClient` follows the redirect, forwarding all custom headers including `X-Leaked-Cred` to `evil.com`. The attacker captures the client's credential.\n\n**Preconditions.**\n- Client application has configured API key credentials via `CredentialService` for the agent's security scheme\n- The agent is malicious or compromised (controls its own AgentCard response)\n- The default `JdkA2AHttpClient` is used (with `followRedirects=NORMAL`)\n- The JDK version does not strip custom headers on cross-origin redirects (all current versions)\n\n**Fix.** Validate the `APIKeySecurityScheme.name()` field against a whitelist of safe header names. Check that `apiKeySecurityScheme.location()` equals `Location.HEADER` before placing the credential as a header. Consider using `followRedirects(NEVER)` and implementing manual redirect handling that strips all authentication headers on cross-origin redirects.\n\n**Verification.** 2/3 lens verifiers confirmed.","summary":"The A2A Java SDK sends the client's API key under a header name chosen by the remote agent's AgentCard, so a malicious agent can pick a custom header. A redirect from that agent then forwards the key to a third-party server.","severity":"medium","cvss":5.7,"epss":0.0014100000262260437,"exploited":false,"exploited_at":null,"products":[{"name":"org.a2aproject.sdk:a2a-java-sdk-parent","fixed":["1.3.0.Final"],"affected":"< 1.3.0.Final","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["a2a","ai-agents","ai-tooling","cwe-522","java","maven"],"not_affected_if":["default-config","no-api-key-credentials","trusted-agents-only"],"how_to_check":"Check whether the pom.xml or lockfile pulls org.a2aproject.sdk:a2a-java-sdk-parent (or a2a-java-sdk modules) below 1.3.0.Final.","fix":"Upgrade the A2A Java SDK to 1.3.0.Final or later.\nUntil then, avoid using API key credentials with untrusted A2A agents.","status":"open","published_at":"2026-10-20T16:17:00+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:56:04+00:00","updated_at":"2026-10-23T21:57:20+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-23T20:56:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the A2A Java SDK to 1.3.0.Final or later.\nUntil then, avoid using API key credentials with untrusted A2A agents.","reach":"internet","impact":"medium","summary":"The A2A Java SDK sends the client's API key under a header name chosen by the remote agent's AgentCard, so a malicious agent can pick a custom header. A redirect from that agent then forwards the key to a third-party server.","category":"ai-tooling","who_cares":["java","a2a","maven","ai-agents"],"confidence":0.7,"needs_auth":"no","worst_case":"Client API key leaks to a third-party server via redirect.","analyst_note":"","how_to_check":"Check whether the pom.xml or lockfile pulls org.a2aproject.sdk:a2a-java-sdk-parent (or a2a-java-sdk modules) below 1.3.0.Final.\nunknown","needs_analyst":false,"not_affected_if":["default-config","no-api-key-credentials","trusted-agents-only"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000569,"input_tokens":3714,"output_tokens":395,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111763':20A,28A '-2026':19A,27A '-522':43B '/collect':303C '2/3':421C '2h4x':24A '302':298C '69':165C '9rhm':23A 'a2a':1A,31A,35B,47B,96C 'a2a-java-sdk-parent':30A 'addit':232C 'agent':38B,64B,70B,80B,97C,117C,175C,222C,256C,263C,294C,338C,343C 'agentcard':66B,120C,177C,266C,351C 'ai':37B,40B 'ai-ag':36B 'ai-tool':39B 'allow':219C 'api':54B,103C,252C,331C 'apikeysecurityschem':123C,272C 'apikeysecurityscheme.location':391C 'apikeysecurityscheme.name':170C,380C 'applic':328C 'arbitrari':111C 'attack':320C 'authent':413C 'authinterceptor':233C,282C 'author':153C,213C 'captur':321C 'caus':99C 'check':236C,389C 'chosen':60B 'client':5A,52B,101C,193C,225C,249C,323C,327C 'client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/authinterceptor.java':164C 'combin':195C 'compromis':95C,347C 'configur':250C,330C 'confirm':424C 'consid':401C 'contain':146C 'control':10A,181C,348C 'cred':278C,291C,316C 'credenti':6A,105C,148C,194C,202C,226C,243C,254C,285C,325C,333C,397C 'credentialservic':335C 'cross':160C,209C,371C,417C 'cross-origin':159C,208C,370C,416C 'current':375C 'custom':74B,126C,144C,204C,310C,367C 'cve':18A,26A 'cwe':42B 'data':182C 'default':354C 'direct':185C 'enabl':14A 'equal':392C 'evil.com':302C,318C 'evil.com/collect':301C 'exploit':247C 'field':171C,381C 'fix':377C 'follow':138C,305C 'followredirect':199C,359C,403C 'forward':82B,108C,142C,308C 'ghsa':22A 'ghsa-9rhm-2h4x-jwmx':21A 'handl':409C 'header':12A,58B,75B,127C,145C,154C,189C,205C,239C,246C,281C,292C,311C,368C,387C,400C,414C 'http':11A,133C,188C,297C 'httpclient':137C 'impact':91C 'implement':406C 'includ':269C,312C 'intercept':167C 'java':2A,32A,44B,48B 'jdk':136C,362C 'jdka2ahttpclient':197C,304C,355C 'jdks':218C 'jwmx':25A 'key':55B,84B,104C,253C,332C 'leak':224C,277C,290C,315C 'leakag':15A 'len':422C 'locat':238C,280C 'location.header':393C 'malici':69B,93C,221C,262C,345C 'manual':407C 'maven':45B 'may':155C 'myauth':260C,270C 'name':13A,59B,128C,190C,206C,274C,388C 'never':404C 'newer':217C 'normal':200C,360C 'org.a2aproject.sdk':29A 'origin':161C,210C,372C,418C 'parent':34A 'parti':89B,114C,230C 'pick':72B 'place':192C,241C,283C,395C 'polici':201C 'precondit':326C 'redirect':17A,77B,134C,140C,162C,211C,299C,307C,373C,408C,419C 'remot':63B,174C 'respond':130C,295C 'respons':352C 'return':264C 'safe':386C 'scenario':248C 'scheme':259C,341C 'sdk':3A,33A,49B 'secur':258C,340C 'securityschem':268C 'send':4A,50B 'serv':118C 'server':9A,90B,115C,180C,231C 'server-control':8A,179C 'sinc':149C 'specifi':124C 'standard':152C 'strip':157C,215C,366C,411C 'surviv':207C 'third':88B,113C,229C 'third-parti':87B,112C,228C 'tool':41B 'untrust':178C 'use':184C,357C,402C 'valid':378C 'verif':420C 'verifi':423C 'version':363C,376C 'via':16A,334C 'whitelist':384C 'x':276C,289C,314C 'x-leaked-cr':275C,288C,313C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9rhm-2h4x-jwmx","url":"https://github.com/advisories/GHSA-9rhm-2h4x-jwmx","severity":"medium","published_at":"2026-10-20T21:04:16+00:00","modified_at":"2026-10-20T21:04:17+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-111763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111763","severity":null,"published_at":"2026-10-20T16:17:00+00:00","modified_at":"2026-10-21T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}