---
id: "CVE-2026-111763"
kind: "vulnerability"
aliases: ["CVE-2026-111763", "GHSA-9rhm-2h4x-jwmx"]
title: "A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect"
severity: "medium"
cvss: 5.7
epss: 0.0014100000262260437
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "org.a2aproject.sdk:a2a-java-sdk-parent", "fixed": ["1.3.0.Final"], "affected": "< 1.3.0.Final", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["a2a", "ai-agents", "ai-tooling", "cwe-522", "java", "maven"]
not_affected_if: ["default-config", "no-api-key-credentials", "trusted-agents-only"]
published_at: "2026-10-20T16:17:00+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:20+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-9rhm-2h4x-jwmx", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111763", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

The A2A Java SDK sends the client's API key under a header name chosen by the remote agent's AgentCard, so a malicious agent can pick a custom header. A redirect from that agent then forwards the key to a third-party server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.a2aproject.sdk:a2a-java-sdk-parent affected < 1.3.0.Final fixed 1.3.0.Final

## How to check

Check whether the pom.xml or lockfile pulls org.a2aproject.sdk:a2a-java-sdk-parent (or a2a-java-sdk modules) below 1.3.0.Final.

## Fix

Upgrade the A2A Java SDK to 1.3.0.Final or later.
Until then, avoid using API key credentials with untrusted A2A agents.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-9rhm-2h4x-jwmx
- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111763

## From the sources

*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an `APIKeySecurityScheme` specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows the redirect and forwards the custom header containing the credential, since only the standard `Authorization` header may be stripped on cross-origin redirects.

**Where.** `client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java:69` in `intercept`

**What.** The `apiKeySecurityScheme.name()` field from the remote agent's AgentCard (untrusted, server-controlled data) is used directly as the HTTP header name when placing client credentials. Combined with `JdkA2AHttpClient`'s `followRedirects(NORMAL)` policy, credentials under custom header names survive cross-origin redirects (only `Authorization` is stripped on newer JDKs), allowing a malicious agent to leak client credentials to third-party servers. Additionally, `AuthInterceptor` does not check that `location==HEADER` before placing the credential as a header.

**Exploit scenario.** Client configures an API key credential for agent's security scheme `myAuth`. The malicious agent returns an AgentCard where `securitySchemes` includes `myAuth` as `APIKeySecurityScheme` with `name='X-Leaked-Cred'` and `location=HEADER`. `AuthInterceptor` places the credential in the `X-Leaked-Cred` header. The agent responds with HTTP 302 redirect to `https://evil.com/collect`. `JdkA2AHttpClient` follows the redirect, forwarding all custom headers including `X-Leaked-Cred` to `evil.com`. The attacker captures the client's credential.

**Preconditions.**
- Client application has configured API key credentials via `CredentialService` for the agent's security scheme
- The agent is malicious or compromised (controls its own AgentCard response)
- The default `JdkA2AHttpClient` is used (with `followRedirects=NORMAL`)
- The JDK version does not strip custom headers on cross-origin redirects (all current versions)

**Fix.** Validate the `APIKeySecurityScheme.name()` field against a whitelist of safe header names. Check that `apiKeySecurityScheme.location()` equals `Location.HEADER` before placing the credential as a header. Consider using `followRedirects(NEVER)` and implementing manual redirect handling that strips all authentication headers on cross-origin redirects.

**Verification.** 2/3 lens verifiers confirmed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_