Product

org.a2aproject.sdk/a2a-java-sdk-parent vulnerabilities

1 published CVE affecting org.a2aproject.sdk/a2a-java-sdk-parent, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 0
High: 0
Medium: 1
Low: 0
Unscored: 0
CISA KEV: 0

Latest org.a2aproject.sdk/a2a-java-sdk-parent CVEs

Newest publication first

CVE-2026-111763 A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect
Published 2026-10-20

MediumCVSS 5.7 EPSS 0.14%

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

org.a2aproject.sdk/a2a-java-sdk-parent vulnerabilities

Latest org.a2aproject.sdk/a2a-java-sdk-parent CVEs

CVE-2026-111763 A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect