CVE-2026-111762

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions prior to 1.3.0.Final

Description The parseRequestBody() function in the RestHandler.java file logs the entire JSON request body at a SEVERE level when JsonFormat.parser().merge() throws an InvalidProtocolBufferException. This occurs when a request body is valid JSON but fails protobuf deserialization due to schema mismatches or unknown fields under strict parsing. When push notifications are enabled, requests to the /v1/tenants/{tenant}/tasks/{taskId}/pushNotificationConfigs endpoint may contain sensitive information in the token and authentication.credentials variables. Consequently, these bearer tokens and authentication credentials are written to server logs in cleartext, allowing an attacker with log access to retrieve them and potentially send forged task status updates to client push notification endpoints.

Recommendations Update A2A Java SDK to version 1.3.0.Final. As a temporary mitigation, restrict access to server log files and log aggregation systems to prevent unauthorized retrieval of credentials.