A2A Java SDK CVE-2026-111764

Requires a multi-caller/multi-tenant deployment of the A2A Java SDK prior to 1.3.0.Final using the default task-store wiring: the no-argument InMemoryTaskStore constructor leaves authorizationProvider null, and no TaskAuthorizationProvider plus AuthorizationRequestHandlerDecorator is installed (via CDI or explicitly). This includes manually built DefaultRequestHandler.builder().build() handlers and integrations such as Spring. Because the default/reference transport endpoints do not enforce authentication, the task-read disclosure is reachable without any account. LIMITING FACTORS: single-user deployments and any deployment that configures a TaskAuthorizationProvider/decorator (or upgrades to 1.3.0.Final, which defaults to fail-closed) are not exposed; the attacker must also know or guess a valid target task ID, so the impact is confined to callers whose task IDs can be obtained or enumerated.

This is a genuine access-control weakness (CWE-862, Missing Authorization) in the A2A Java SDK's default InMemoryTaskStore, scored CVSS 7.5 with a clean network vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The signals are internally consistent: the description confirms the reference transport endpoints do not enforce authentication and InMemoryTaskStore.get(taskId) returns tasks without any owner/caller check, which supports AV:N, AC:L, PR:N, UI:N, and a pure confidentiality impact (C:H / I:N / A:N). Exploitation status is 'no public exploit identified at time of analysis' - no EPSS score, no CISA KEV listing, and no POC indicator were provided in the input, so there is no evidence of active or widespread exploitation; this is a vendor/GitHub-advisory-driven disclosure with a patch, not a KEV-confirmed in-the-wild issue. The one qualifier that lowers real-world risk below the raw 7.5 is a non-CVSS prerequisite stated in the description: the flaw only matters in a multi-caller/multi-tenant deployment using the default (no authorization-provider) configuration, and the attacker must know or guess another caller's task ID (IDOR-style). The low value sits in CVSS complexity terms but is a meaningful limiter operationally. SSVC-style read: exploitation = none observed, automatable = yes (task-read requests can be scripted/ID-enumerated), technical impact = partial (information disclosure only, no integrity/availability). Net: a real priority for anyone running the pre-1.3.0.Final SDK in a shared/multi-tenant mode, but lower urgency for single-user or already authorization-decorated deployments.

An organization runs an A2A agent server built on the A2A Java SDK (e.g., via Spring or a manually built DefaultRequestHandler) serving multiple callers, with the default InMemoryTaskStore and no TaskAuthorizationProvider. An unauthenticated attacker who learns or guesses a victim caller's task ID issues a task-read request to the unprotected reference transport endpoint and receives that task's status, context ID, full message history, and artifacts belonging to another caller. No public exploit code was identified in the provided data, but exploitation requires only a standard protocol request, so it is easily scriptable.