Listen to this Post
The vulnerability identified as CVE-2026-111763 affects the A2A Java SDK, specifically within the AuthInterceptor component responsible for handling client authentication credentials.
In this security flaw, the remote A2A agent provides an untrusted AgentCard containing an APIKeySecurityScheme.
The SDK takes the `apiKeySecurityScheme.name()` field directly from this server-controlled data and uses it as the HTTP header name for attaching client credentials.
When a client application is configured to use API key credentials for an agent’s security scheme, the interceptor places the secret credential into the header specified by the remote agent.
Compounded by the default `JdkA2AHttpClient` policy of followRedirects(NORMAL), the client transport client automatically follows any HTTP redirect responses issued by the server.
While modern JDK HTTP clients strip the standard `Authorization` header during cross-origin redirects for security, they do not automatically strip custom HTTP headers.
Consequently, if a malicious or compromised A2A agent responds with an HTTP 302 redirect pointing to an external third-party domain, the custom header containing the client’s sensitive credential survives the redirect.
The JDK HttpClient forwards all custom headers along with the redirect request to the attacker’s server.
This allows the malicious third-party server to capture the confidential API key credential successfully.
Furthermore, the vulnerable interceptor logic fails to validate the `apiKeySecurityScheme.name()` against any whitelist of safe header names.
It also fails to check whether the `location` field equals `HEADER` before placing the credential.
This oversight grants untrusted remote servers complete control over both the naming and transmission mechanism of sensitive client authentication tokens.
Remediation requires validating header names against a safe whitelist and enforcing strict location checks.
DailyCVE Form:
Platform: A2A Java SDK
Version: All prior versions
Vulnerability: Credential leakage redirect
Severity: Medium severity
date: October 2026
Prediction: Patched in October
What Undercode Say:
git clone https://github.com/a2aproject/a2a-java.git cd a2a-java mvn clean install
// Vulnerable AuthInterceptor snippet String headerName = apiKeySecurityScheme.name(); request.setHeader(headerName, credential);
Exploit: (Educational Purposes!)
An attacker deploys a malicious A2A agent that serves a customized AgentCard containing an `APIKeySecurityScheme` with a custom header name such as X-Leaked-Cred. The client SDK uses this untrusted name to place its API key credential. The malicious agent then issues an HTTP 302 redirect pointing to [https://evil.com/collect](https://evil.com/collect). Because `JdkA2AHttpClient` uses `followRedirects(NORMAL)` and does not strip custom headers during cross-origin redirection, the request carrying `X-Leaked-Cred` is sent directly to the attacker’s endpoint, resulting in full credential exposure.
Protection: from this CVE
Developers must upgrade the A2A Java SDK to the latest patched version where the vulnerability is resolved.
Implement strict validation of the `APIKeySecurityScheme.name()` field against an approved whitelist of safe header names.
Explicitly verify that `apiKeySecurityScheme.location()` equals `Location.HEADER` prior to injecting credentials.
Configure HTTP clients with `followRedirects(NEVER)` or implement custom manual redirect handlers that purge all authentication and custom headers upon crossing origins.
Impact:
A malicious or compromised A2A agent can successfully force client applications to forward sensitive API key credentials to arbitrary third-party servers. This exposure leads to unauthorized access, potential data breaches, account takeover, and full compromise of downstream services authenticated using the leaked credentials.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
