org.a2aproject.sdk/a2a-java-sdk-server-common vulnerabilities

Latest org.a2aproject.sdk/a2a-java-sdk-server-common CVEs

Newest publication first

1. CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

   Published 2026-10-20

   High·CVSS 7.5 EPSS 0.60%

   A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.get(String ta...

2. CVE-2026-111761 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

   Published 2026-10-20

   Medium·CVSS 5.8 EPSS 0.59%

   A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects. InMemo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.