Is CVE-2026-111765 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111765 being exploited in the wild.

How severe is CVE-2026-111765?

High severity, with a CVSS score of 7.5, published 20 October 2026.

Which products and versions are affected?

A2A Project A2A Java SDK 1.3.0.Final to 1.3.2.Final; org.a2aproject.sdk:a2a-java-sdk-http-client-android (Maven) >= 1.3.0.Final, <= 1.3.1.Final, ECOSYSTEM:introduced=1.3.0.Final,fixed=1.3.2.Final.

How is CVE-2026-111765 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111765?

Check whether you run A2A Project A2A Java SDK or org.a2aproject.sdk:a2a-java-sdk-http-client-android (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111765: A2A Java SDK credential disclosure via HTTP redirect

Q: Is there a fix for CVE-2026-111765?

Yes. org.a2aproject.sdk:a2a-java-sdk-http-client-android (Maven): upgrade to 1.3.2.Final or later. Until then: Explicitly disable automatic HTTP redirects in client configurations by setting followRedirects(false) until upgrading to the patched version. [{"kind":"disclosed","at":"2026-10-20"},{"kind":"patched","at":"2026-08-26","note":"Fix committed; version 1.3.2.Final released"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-111765 · Severity: high · CVSS 7.5 · Published 2026-10-20

The A2A Java SDK is a library that applications use to communicate via the Agent2Agent protocol. When applications redirect HTTP requests, the SDK fails to strip authentication credentials (API keys and tokens) from the redirected requests, allowing an attacker who controls a redirect target to capture these credentials. This can lead to account takeover or API abuse if the attacker gains access to valid API keys or authentication tokens.

Technologies: A2A Project A2A Java SDK. Vendors: A2A Project, Maven.

Quick answers

Is CVE-2026-111765 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111765 being exploited in the wild.
How severe is CVE-2026-111765?: High severity, with a CVSS score of 7.5, published 20 October 2026.
Which products and versions are affected?: A2A Project A2A Java SDK 1.3.0.Final to 1.3.2.Final; org.a2aproject.sdk:a2a-java-sdk-http-client-android (Maven) >= 1.3.0.Final, <= 1.3.1.Final, ECOSYSTEM:introduced=1.3.0.Final,fixed=1.3.2.Final.
Is there a fix for CVE-2026-111765?: Yes. org.a2aproject.sdk:a2a-java-sdk-http-client-android (Maven): upgrade to 1.3.2.Final or later. Until then: Explicitly disable automatic HTTP redirects in client configurations by setting followRedirects(false) until upgrading to the patched version.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-20"},{"kind":"patched","at":"2026-08-26","note":"Fix committed; version 1.3.2.Final released"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111765 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111765?: Check whether you run A2A Project A2A Java SDK or org.a2aproject.sdk:a2a-java-sdk-http-client-android (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.a2aproject.sdk:a2a-java-sdk-http-client-android (Maven): upgrade to 1.3.2.Final or later

# set org.a2aproject.sdk:a2a-java-sdk-http-client-android to 1.3.2.Final in your pom.xml or build.gradle

Explicitly disable automatic HTTP redirects in client configurations by setting followRedirects(false) until upgrading to the patched version.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-20"},{"kind":"patched","at":"2026-08-26","note":"Fix committed; version 1.3.2.Final released"}]

Technical details

The AndroidA2AHttpClient, JSONRPCTransport, and RestTransport components override HTTP redirect settings and retain non-standard authentication headers (X-API-Key, API-Key, X-Auth-Token, X-Authentication) across cross-authority redirects, contrary to OkHttp's default behavior of stripping the Authorization header. An attacker controlling a redirect target receives the plaintext credential from the initial request. This affects autonomous clients without user interaction and user-invoked workflows depending on context.

Affected products

A2A Project A2A Java SDK 1.3.0.Final to 1.3.2.Final

Identifiers

CVE-2026-111765
GHSA-4fpj-g9jf-9rgg

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.