Executive brief
a2a-java is a Java SDK for the Agent2Agent protocol used for secure task and workflow management. A vulnerability in the onListTasks function fails to perform required authorization checks, allowing an attacker to bypass access controls and list tasks they should not be permitted to view.
Technical details
The vulnerability is an authorization bypass in the AuthorizationRequestHandlerDecorator.onListTasks method. Unlike other handler methods, onListTasks delegated directly to the underlying handler without performing authorization checks before exposing the list of tasks. The flaw allows a remote attacker to call onListTasks and retrieve a complete task list regardless of their permissions. The fix adds a list-scoped checkRead authorization check using an empty-string sentinel for the whole list scope before delegation. This vulnerability requires network access to the a2a-java service but does not require authentication or user interaction beyond a direct method call.
Affected products
- a2aproject a2a-java 1.2.0
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fix available in version 1.3.0 (commit e9a1abf9c90c02b16d17293afdc3cc2f555d63a6)