CVE-2026-111763: 
Java vulnerability analysis and mitigation

CVE-2026-111763 is a credential leakage vulnerability in the A2A Java SDK (the official Java SDK for the Agent2Agent Protocol) that allows a malicious or compromised remote agent to cause the client to forward API key credentials to an arbitrary third-party server. It affects versions prior to 1.3.0.Final of the org.a2aproject.sdk:a2a-java-sdk-parent Maven package. The vulnerability was published on October 20, 2026, and a patch was released in version 1.3.0.Final. It carries a CVSS v4.0 base score of 5.7 (Medium) (GitHub Advisory).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials). In AuthInterceptor.intercept(), the APIKeySecurityScheme.name() field — sourced directly from the remote agent's untrusted AgentCard — is used as the HTTP header name for credential injection without validating that the declared location is HEADER or that the header name is safe. The JdkA2AHttpClient is configured with followRedirects(NORMAL), which causes it to follow cross-origin redirects; because only the standard Authorization header is stripped on such redirects by modern JDKs, any custom credential-bearing header (e.g., X-Leaked-Cred) is forwarded to the redirect destination. Exploitation requires that the client has configured API key credentials via CredentialService and that the attacker controls the agent's AgentCard response and can issue an HTTP redirect to an attacker-controlled server (GitHub Advisory, Fix PR).

A successful exploit results in full disclosure of the client's API key credential to an attacker-controlled third-party server, with no integrity or availability impact. The exposed credential could subsequently be used to impersonate the victim client against the legitimate agent service, potentially enabling unauthorized access to agent-mediated resources or lateral movement within agent-to-agent workflows. The impact is limited to confidentiality — specifically the theft of API key tokens — and does not involve code execution or host compromise (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to control a remote agent's AgentCard and redirect response, and the victim client must have API key credentials configured for that agent's security scheme — reducing the practical attack surface (GitHub Advisory, Feedly).

1. Set up a malicious agent: Deploy or compromise a remote A2A agent that the target client is configured to communicate with, ensuring control over the agent's AgentCard endpoint and HTTP responses.
2. Craft a malicious AgentCard: Serve an AgentCard where the securitySchemes entry for the client's configured scheme (e.g., myAuth) is an APIKeySecurityScheme with a custom name such as X-Leaked-Cred and location=HEADER.
3. Trigger credential injection: When the victim client sends a request, AuthInterceptor reads apiKeySecurityScheme.name() from the AgentCard and places the API key credential into the X-Leaked-Cred HTTP header without validation.
4. Issue a cross-origin redirect: Respond to the client's request with an HTTP 302 redirect pointing to an attacker-controlled server (e.g., https://evil.com/collect).
5. Capture the credential: Because JdkA2AHttpClient uses followRedirects(NORMAL) and only strips the Authorization header on cross-origin redirects, the custom X-Leaked-Cred header containing the API key is forwarded to the attacker's server, where it can be logged and captured (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from the A2A client to unfamiliar or external hosts following an initial request to a known agent endpoint; HTTP redirects (302) from agent servers pointing to cross-origin destinations.
• Logs: HTTP client logs showing requests to third-party URLs with non-standard authentication headers (e.g., X-Leaked-Cred, X-API-Key, API-Key, X-Auth-Token, X-Authentication) that were not explicitly configured by the application.
• Application Behavior: Agent responses containing Location headers redirecting to domains outside the expected agent infrastructure; AgentCard security scheme definitions specifying unusual or arbitrary header names not in the standard allowlist (authorization, x-api-key, api-key, x-auth-token, x-authentication) (GitHub Advisory).

Upgrade the A2A Java SDK to version 1.3.0.Final or later, which introduces a safe header name allowlist in AuthInterceptor (permitting only authorization, x-api-key, api-key, x-auth-token, and x-authentication), validates that APIKeySecurityScheme.location() equals HEADER before injecting credentials, and disables automatic HTTP redirect following across all HTTP client implementations (JDK, Vert.x, Android). As a workaround prior to patching, restrict which remote agents the client connects to and implement network-level controls to block unexpected redirect destinations. Review all agent AgentCard configurations to ensure security schemes use only standard, expected header names (GitHub Advisory, v1.3.0.Final Release).