CVE-2026-111764

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions prior to 1.3.0.Final

Description The default InMemoryTaskStore configuration does not perform authorization on task reads. The no-argument constructor sets the authorizationProvider to null, and the get(String taskId) function returns the stored task without verifying the caller or owner. Authorization is only enforced if the application provides a TaskAuthorizationProvider and routes requests through the AuthorizationRequestHandlerDecorator. In deployments using default store wiring, manually constructed DefaultRequestHandler.builder().build() handlers, or integrations like Spring, task reads remain unprotected. Consequently, an unauthenticated caller who knows or guesses a taskId can retrieve sensitive information, including task status, context ID, message history, and artifacts. This is particularly critical in multi-caller deployments where the default transport endpoints do not enforce authentication.

Recommendations Update A2A Java SDK to version 1.3.0.Final. As a temporary workaround, configure a TaskAuthorizationProvider and ensure requests are routed through the AuthorizationRequestHandlerDecorator via CDI wiring instead of using the default no-arg store or a manually built handler.