CVE-2026-111763

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions prior to 1.3.0.Final

Description A malicious or compromised remote agent can cause the default JDK-based client to leak a configured API key to a third-party server. This occurs because the AuthInterceptor.intercept() function in client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java uses the APIKeySecurityScheme.name() value from a remote AgentCard directly as the HTTP header name without verifying that the location is set to HEADER. Since JdkA2AHttpClient uses followRedirects(NORMAL), an agent-controlled cross-origin redirect can forward this custom credential-bearing header to an external server, as only the standard Authorization header is typically stripped during such redirects. The attack requires the client to have configured API key credentials via CredentialService and the attacker to control the agent's AgentCard and redirect response.

Recommendations Update to version 1.3.0.Final. As a temporary workaround, consider using followRedirects(NEVER) and implementing manual redirect handling that strips all authentication headers on cross-origin redirects.