{"schema":"threatline.record/2","record":{"id":"CVE-2026-111763","aliases":["CVE-2026-111765","GHSA-4fpj-g9jf-9rgg","GHSA-9rhm-2h4x-jwmx"],"summary":"A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect","details":"*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an `APIKeySecurityScheme` specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows the redirect and forwards the custom header containing the credential, since only the standard `Authorization` header may be stripped on cross-origin redirects.\n\n**Where.** `client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java:69` in `intercept`\n\n**What.** The `apiKeySecurityScheme.name()` field from the remote agent's AgentCard (untrusted, server-controlled data) is used directly as the HTTP header name when placing client credentials. Combined with `JdkA2AHttpClient`'s `followRedirects(NORMAL)` policy, credentials under custom header names survive cross-origin redirects (only `Authorization` is stripped on newer JDKs), allowing a malicious agent to leak client credentials to third-party servers. Additionally, `AuthInterceptor` does not check that `location==HEADER` before placing the credential as a header.\n\n**Exploit scenario.** Client configures an API key credential for agent's security scheme `myAuth`. The malicious agent returns an AgentCard where `securitySchemes` includes `myAuth` as `APIKeySecurityScheme` with `name='X-Leaked-Cred'` and `location=HEADER`. `AuthInterceptor` places the credential in the `X-Leaked-Cred` header. The agent responds with HTTP 302 redirect to `https://evil.com/collect`. `JdkA2AHttpClient` follows the redirect, forwarding all custom headers including `X-Leaked-Cred` to `evil.com`. The attacker captures the client's credential.\n\n**Preconditions.**\n- Client application has configured API key credentials via `CredentialService` for the agent's security scheme\n- The agent is malicious or compromised (controls its own AgentCard response)\n- The default `JdkA2AHttpClient` is used (with `followRedirects=NORMAL`)\n- The JDK version does not strip custom headers on cross-origin redirects (all current versions)\n\n**Fix.** Validate the `APIKeySecurityScheme.name()` field against a whitelist of safe header names. Check that `apiKeySecurityScheme.location()` equals `Location.HEADER` before placing the credential as a header. Consider using `followRedirects(NEVER)` and implementing manual redirect handling that strips all authentication headers on cross-origin redirects.\n\n**Verification.** 2/3 lens verifiers confirmed.","categories":["Libraries & packages"],"product":"org.a2aproject.sdk:a2a-java-sdk-parent","vendor":"a2aproject","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9rhm-2h4x-jwmx","source_modified_at":"2026-10-20T21:04:17Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.a2aproject.sdk:a2a-java-sdk-parent"},"range":"< 1.3.0.Final"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111763","source_modified_at":"2026-10-21T15:54:55.582Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"a2a-java","vendor":"a2aproject","versions":[{"version":"< 1.3.0.Final","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4fpj-g9jf-9rgg","source_modified_at":"2026-10-21T03:11:56.305391879Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.a2aproject.sdk:a2a-java-sdk-http-client-android","ecosystem":"Maven","purl":"pkg:maven/org.a2aproject.sdk/a2a-java-sdk-http-client-android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0.Final"},{"fixed":"1.3.2.Final"}]}],"versions":["1.3.0.Final","1.3.1.Final"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9rhm-2h4x-jwmx","source_modified_at":"2026-10-20T21:04:17Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.a2aproject.sdk:a2a-java-sdk-parent"},"version":"1.3.0.Final"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4fpj-g9jf-9rgg","source_modified_at":"2026-10-21T03:11:56.305391879Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.a2aproject.sdk:a2a-java-sdk-http-client-android","ecosystem":"Maven","purl":"pkg:maven/org.a2aproject.sdk/a2a-java-sdk-http-client-android"},"version":"1.3.2.Final"}],"cvss":5.7,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00141,"percentile":0.03109,"score_date":"2026-10-23"},"published_at":"2026-10-20T15:03:28.034Z","modified_at":"2026-10-21T15:54:55.582Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-9rhm-2h4x-jwmx","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-20T21:04:17Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111763","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T15:54:55.582Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-4fpj-g9jf-9rgg","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T03:11:56.305391879Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111763","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/a2aproject/a2a-java/security/advisories/GHSA-4fpj-g9jf-9rgg","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/a2aproject/a2a-java/security/advisories/GHSA-9rhm-2h4x-jwmx","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111763","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/a2aproject/a2a-java/pull/1097","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-9rhm-2h4x-jwmx","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-21T14:24:21.910904Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T15:54:55.582Z","content_hash":"e4cb4830fc6a900f2cef5a0acd331130eca037bb73acc846655d99abfbae601b"}}