Security incident · CVE-2026-111765

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol.

Q: Which versions are affected?

Compare what you have installed with 1.3.0.Final → 1.3.2.Final, >= 1.3.0.Final, <= 1.3.1.Final. Compare the installed version with the linked vendor advisory before you change production.

Q: What should an analyst verify?

CWE-522: Insufficiently Protected Credentials. EPSS 0.80%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Published Oct 20, 2026 · catalog updated Oct 21, 2026 · A2A Java SDK is

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-111765. EPSS is 0.80%. Act only if a listed version of A2A Java SDK is is installed.

Gaps on this record

The stored product name is a package slug. The name on this page is taken from the title (A2A Java SDK is).
No vendor fix or required action is stored. Compare the linked advisory before you change production.

Severity: High7.5
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 0.80%
Remediation: Version ranges on file
Affected products: Maven org.a2aproject.sdk:a2a-java-sdk-http-client-android · maven org.a2aproject.sdk:a2a-java-sdk-http-client-android

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowRedirects(false); The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post() throws IOException { HttpURLConnection connection = createConnection("POST", false); connection.setInstanceFollowRedirects(followRedirects); // ... } The second assignment wins. JSONRPCTransport and RestTransport both add interceptor-produced headers and call synchronous post() without setting followRedirects(false). On Android's repackaged OkHttp implementation, a cross-authority redirect strips Authorization but retains nonstandard request headers. AuthInterceptor permits four nonstandard authentication header names: X-API-Key API-Key X-Auth-Token X-Authentication I confirmed that the exact v1.3.1.Final Maven artifact forwards complete synthetic values under all four names to a second loopback authority. I also reproduced the supported AuthInterceptor to Android POST path. Explicitly calling followRedirects(false) returns the original 302 and produces no request to the collector. All test traffic stayed on two ephemeral 127.0.0.1 listeners. All credentials were synthetic FULCRUM-SYNTHETIC-* values. Reproduction I have attached AndroidA2AHttpClientRedirectTest.java. Copy it to: extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/ Run: mvn -pl extras/http-client-android -am \ -Dtest=AndroidA2AHttpClientRedirectTest \ -Dsurefire.failIfNoSpecifiedTests=false test On unpatched current main, the default test fails with: Android synchronous POST must retain the documented no-redirect default expected: but was: The explicit followRedirects(true) control still passes. The separate exact-artifact fixture passed three consecutive runs. Its relevant output was: default status=200 x-api-key=FULCRUM-SYNTHETIC-DIRECT authorization=null method=GET control-followRedirects-false status=302 collectorHits=0 i

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

Maven org.a2aproject.sdk:a2a-java-sdk-http-client-android1.3.0.Final → 1.3.2.Final
maven org.a2aproject.sdk:a2a-java-sdk-http-client-android>= 1.3.0.Final, <= 1.3.1.Final

How to fix CVE-2026-111765

Upgrade
CVE-2026-111765 lists a fix boundary at 1.3.2.Final. Compare the installed build with that boundary before you change production.
Version check
Affected <= 1.3.1.Final
Advisory
Open the cve_org record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-111765. EPSS is 0.80%. Act only if a listed version of A2A Java SDK is is installed.

Which versions are affected?

Compare what you have installed with 1.3.0.Final → 1.3.2.Final, >= 1.3.0.Final, <= 1.3.1.Final. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-522: Insufficiently Protected Credentials. EPSS 0.80%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Oct 20, 2026 · NIST NVD
Detected
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection() with the PostBuilder default followRedirects value of true, leaving a residual of the earlier credential-redirect fix. JSONRPCTran
Oct 20, 2026 · NIST NVD
Updated
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection() with the PostBuilder default followRedirects value of true, leaving a residual of the earlier credential-redirect fix. JSONRPCTran
Oct 21, 2026 · GitHub Advisory Database
Fix available
org.a2aproject.sdk:a2a-java-sdk-http-client-android fixed in 1.3.2.Final
Oct 21, 2026 · GitHub Advisory Database
Fix available
org.a2aproject.sdk:a2a-java-sdk-http-client-android fixed in 1.3.2.Final
Oct 21, 2026 · GitHub Advisory Database
Updated
The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowRedirects(false); The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post() throws IOException { HttpURLConnection connection = createConnection("POST", false); connection.setInstanceFollowRedirects(followRedirects); // ...

Sources

CVE.orgVulnerability recordCVE-2026-111765
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-111765
30-day exploitation probability 0.80%
first.org
GitHub Advisory DatabasePackage advisoryGHSA-4fpj-g9jf-9rgg
GitHub Advisory Database record mirrored by OSV.
github.com
NIST NVDVulnerability recordCVE-2026-111765
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection() with the P
nvd.nist.gov
OpenSSF OSV / OSV ScannerPackage advisoryGHSA-4fpj-g9jf-9rgg
A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
osv.dev

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

FIRST EPSSNov 6, 2026
GitHub Advisory DatabaseOct 23, 2026
OpenSSF OSV / OSV ScannerOct 23, 2026
CVE.orgOct 21, 2026
NIST NVDOct 21, 2026

Priority score

17/100

Evidence confidence: High

Several independent sources name this vulnerability.

Confirmed exploitation0/30
EPSS probability1/20
CVSS severity11/15
Public exploit0/10
Internet exposure0/10
Product prevalence5/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

High

CVSS severity
7.5 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS probability
0.80% · p56.43%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Version ranges on file
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.

Stacks

Android Maven

Weakness

CWE-522
Insufficiently Protected Credentials
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.