A2A Java SDK CVE-2026-111765

Requires use of the AndroidA2AHttpClient (v1.3.0.Final-1.3.1.Final) via JSONRPCTransport or RestTransport on the synchronous post() path, with AuthInterceptor configured to inject a credential in a nonstandard header (X-API-Key, API-Key, X-Auth-Token, or X-Authentication) - standard Authorization headers are stripped by OkHttp on cross-authority redirect and are NOT affected. Exploitation also requires an attacker-controlled or compromised cross-authority redirect/front-door operating in a different trust domain (a fully malicious initial origin gets the credential on the first request regardless). Limiting factors: the leak only occurs when followRedirects is left at its default true (explicit followRedirects(false) prevents it, and the fix sets the default to false); the async/SSE paths are not the vector; autonomous clients leak without interaction while user-invoked workflows may require user action; impact is limited to disclosure of the configured key/token with no further integrity/availability/RCE impact.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) reflects a network-reachable, low-complexity, confidentiality-only flaw. However, the raw score overstates turnkey exploitability: real-world exploitation requires an attacker to control or compromise a redirect/front-door target in a different trust domain so that the Android client follows a cross-authority redirect and leaks the API key - a completely malicious initial origin already obtains the credential on the first request without needing this bug. No EPSS probability, CISA KEV status, or SSVC decision data was provided in the input, so automatable/exploitation-maturity signals cannot be weighed. There is no public exploit identified at time of analysis (the referenced PR #1141 contains fix-verification redirect tests, not a weaponized exploit - do not conflate the two). Net: this is a legitimate credential-leak defect in a specific client configuration rather than a mass-exploited, high-urgency issue; impact is bounded to disclosure of a configured API key/token (no integrity, availability, code execution, or host compromise), and the affected product has a small deployment footprint, so prioritize patching for teams using the Android A2A client with configured credentials but treat broad emergency urgency as unsupported by available signals.

An autonomous A2A Java agent on Android (v1.3.0.Final-1.3.1.Final) is configured with an API key and calls an A2A endpoint via JSONRPCTransport/RestTransport synchronous post(); the endpoint or a compromised front-door returns an HTTP redirect to an attacker-controlled authority. Because the synchronous POST path leaves followRedirects=true and Android's repackaged OkHttp retains nonstandard headers (X-API-Key, API-Key, X-Auth-Token, X-Authentication) across authorities, the full credential is transmitted to the attacker's host. No public exploit is identified; exploitation is low-complexity (AC:L) and needs no attacker authentication (PR:N), and autonomous clients require no human interaction.