CVE-2026-111762: A2A Java SDK credentials leak in error logs

CVE-2026-111762 · Severity: medium · CVSS 4 · Published 2026-10-20

The A2A Java SDK is used to implement the Agent2Agent Protocol for task and notification management. When processing malformed requests, the SDK logs the full request body at SEVERE level, which can include sensitive bearer tokens and credentials for push notification endpoints. An attacker with access to server logs can retrieve these credentials and use them to send forged task status updates to client systems.

Vendors: A2aproject, Maven.

Quick answers

Is CVE-2026-111762 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111762 being exploited in the wild.
How severe is CVE-2026-111762?
Medium severity, with a CVSS score of 4, published 20 October 2026.
Which products and versions are affected?
A2aproject A2A Java SDK before 1.3.0.Final; org.a2aproject.sdk:a2a-java-sdk-transport-rest (Maven) < 1.3.0.Final, ECOSYSTEM:introduced=0,fixed=1.3.0.Final.
Is there a fix for CVE-2026-111762?
Yes. org.a2aproject.sdk:a2a-java-sdk-transport-rest (Maven): upgrade to 1.3.0.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111762 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-111762?
Check whether you run A2aproject A2A Java SDK or org.a2aproject.sdk:a2a-java-sdk-transport-rest (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.a2aproject.sdk:a2a-java-sdk-transport-rest (Maven): upgrade to 1.3.0.Final or later
    # set org.a2aproject.sdk:a2a-java-sdk-transport-rest to 1.3.0.Final in your pom.xml or build.gradle

Technical details

RestHandler.parseRequestBody logs the entire JSON request body at SEVERE level when protobuf deserialization fails via JsonFormat.parser().merge(). The push notification configuration endpoint accepts bearer tokens and authentication credentials in the token and authentication.credentials fields; a malformed but valid JSON body (e.g., with an unknown field or schema mismatch) triggers the logging. An attacker with read access to server logs or a log aggregation system can extract the credentials.

Affected products

  • a2aproject A2A Java SDK before 1.3.0.Final

Identifiers

  • CVE-2026-111762
  • GHSA-x32g-jvvm-4725

Timeline

  • 2026-10-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.