CVE-2026-111761

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions prior to 1.3.0.Final

Description An unauthenticated caller can coerce the server into issuing HTTP requests to arbitrary internal and cloud-metadata endpoints from the server's own network position. This occurs because the BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects. Additionally, InMemoryPushNotificationConfigStore.setInfo stores URLs verbatim, and onCreateTaskPushNotificationConfig fails to validate the destination.

Technical details include:

Both JdkA2AHttpClient and VertxA2AHttpClient follow redirects, which allows attackers to bypass creation-time checks and convert a POST request into a GET request. This enables access to GET-only endpoints, such as cloud-metadata services. Furthermore, hostname-only checks do not prevent DNS rebinding. While direct POST delivery can push attacker-influenced data into internal services, redirected requests drop the body. The server discards the response, meaning no data is read back to the attacker.

Recommendations Update A2A Java SDK to version 1.3.0.Final. As a temporary workaround, block the host's outbound egress to the metadata endpoint and internal network ranges at the network layer.