{"id":"CVE-2026-111765","summary":"A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix","details":"A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection() with the PostBuilder default followRedirects value of true, leaving a residual of the earlier credential-redirect fix. JSONRPCTransport and RestTransport add interceptor-produced authentication headers and call synchronous post() without disabling redirects. AuthInterceptor permits X-API-Key, API-Key, X-Auth-Token, and X-Authentication headers; Android's repackaged OkHttp strips Authorization on cross-authority redirects but retains these nonstandard headers, disclosing a complete configured API key or token to another authority. The additional exposure applies when redirect or front-door behavior is compromised separately from the credential-handling component, or those components operate in different trust domains; a completely malicious initial origin already receives the credential on the first request. Autonomous clients require no human action, while user-invoked workflows can require interaction. Explicit followRedirects(false) prevents the redirected request. The demonstrated impact is credential disclosure, not subsequent credential use, integrity or availability impact, code execution, or host compromise. This issue is fixed in version 1.3.2.Final.","aliases":["GHSA-4fpj-g9jf-9rgg"],"modified":"2026-10-21T09:36:47.394496725Z","published":"2026-10-20T15:10:51.321Z","related":["GHSA-4fpj-g9jf-9rgg","GHSA-9rhm-2h4x-jwmx"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-522"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111765.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111765.json"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/blob/30e31086e24bea096b5f662088661269c9119100/SECURITY.md#L335-L342"},{"type":"FIX","url":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e"},{"type":"FIX","url":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5"},{"type":"FIX","url":"https://github.com/a2aproject/a2a-java/pull/1141"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/releases/tag/v1.3.2.Final"},{"type":"ADVISORY","url":"https://github.com/a2aproject/a2a-java/security/advisories/GHSA-4fpj-g9jf-9rgg"},{"type":"ADVISORY","url":"https://github.com/a2aproject/a2a-java/security/advisories/GHSA-9rhm-2h4x-jwmx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111765"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/a2aproject/a2a-java","events":[{"introduced":"43bde91e3319f0a92db3ac2104215dcdbbb77679"},{"fixed":"d4da07e64fc1a20a48224719a38ba8401927dc1f"},{"fixed":"2a36530d75e11bcf9b81f543464dbe193ca6478e"},{"fixed":"3ae82912a106a6765d7b78042b0ef96e6c2e29b5"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"1.3.0.Final"},{"fixed":"1.3.2.Final"}]},{"range":[{"fixed":"2a36530d75e11bcf9b81f543464dbe193ca6478e"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"3ae82912a106a6765d7b78042b0ef96e6c2e29b5"}]},{"original_tag":"v1.3.2.Final","range":[{"fixed":"d4da07e64fc1a20a48224719a38ba8401927dc1f"}],"source":"REFERENCES_TAG"}]}}],"versions":["v1.3.1.Final","v1.3.0.Final"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"file":"http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java","function":"asyncRequest"},"deprecated":false,"digest":{"function_hash":"219171189031750049188923032470881803419","length":2550},"id":"CVE-2026-111765-09ab50c5","signature_type":"Function"},{"digest":{"line_hashes":["233082241354066570813448180093819670417","21519454768660744913287845070093521544","18030520525811837464370654786568188951","289629073483532029468060426450878048712","162239936067183603071663074933724620488","89111830209238864026470161315079973490","169959603564394047366869435914847288247","254161678224940017379456498614838482171","40335406073137209539280606140796949474","284508063442370397363122920376349187820","272209893532989451563738884913639550567","66762504358454520752952135136815333074","274301807992458639323495873826446669001","281891372236640844937113543641842568745","52917372251392254278158590023034728279"],"threshold":0.9},"id":"CVE-2026-111765-17493e20","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","target":{"file":"compat-0.3/client/transport/spi/src/main/java/org/a2aproject/sdk/compat03/client/transport/spi/interceptors/auth/AuthInterceptor_v0_3.java"},"deprecated":false},{"deprecated":false,"digest":{"length":363,"function_hash":"204773715808667608047604044959259281004"},"id":"CVE-2026-111765-2153aea9","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","target":{"file":"extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java","function":"VertxA2AHttpClient"}},{"id":"CVE-2026-111765-239dfcc4","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","target":{"file":"extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java"},"deprecated":false,"digest":{"line_hashes":["190876308099512679037918443197519236736","144160933694688363382547765301070970662","225493822003427586839351171994332203752","239560352354722651028959120347820178302","337585807637982261768192806754771830941","206911232849714040388715472937903947802","316580792110581946873857470281069245275","182812543732604489279233747690460707521","91040172658669801121819772347520874416","1075545198676391902019372215048106919","299112507834046490542500379518494130976","147092611676183227464636137883663696219","194799622116183726113803145718839914104","182405875434630862249133449391971047943","8992000492734226684290204923387605083","91040172658669801121819772347520874416","1075545198676391902019372215048106919"],"threshold":0.9}},{"source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","target":{"file":"http-client/src/test/java/org/a2aproject/sdk/client/http/JdkA2AHttpClientTest.java","function":"testPostDefaultFollowsRedirect"},"deprecated":false,"digest":{"length":755,"function_hash":"145399924160033703551221735275526671294"},"id":"CVE-2026-111765-27ca9ea6","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"file":"extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java","function":"testBuilderHeaderSetting"},"deprecated":false,"digest":{"length":224,"function_hash":"19341850345270682614870652988558316461"},"id":"CVE-2026-111765-376afe49","signature_type":"Function"},{"id":"CVE-2026-111765-4c93f019","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","target":{"function":"intercept","file":"client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java"},"deprecated":false,"digest":{"function_hash":"1195987301821790159022241056572259765","length":1521}},{"deprecated":false,"digest":{"function_hash":"312528904333584461332748235057310317033","length":216},"id":"CVE-2026-111765-5c9e8dee","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"file":"extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java","function":"testBuilderUrlSetting"}},{"id":"CVE-2026-111765-6dbd2b5d","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","target":{"file":"extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java","function":"createConnection"},"deprecated":false,"digest":{"length":559,"function_hash":"20949775831087824212826406266159733011"}},{"id":"CVE-2026-111765-7d333dfe","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","target":{"file":"compat-0.3/client/transport/spi/src/main/java/org/a2aproject/sdk/compat03/client/transport/spi/interceptors/auth/AuthInterceptor_v0_3.java","function":"intercept"},"deprecated":false,"digest":{"function_hash":"89640935899603841863224742583571727185","length":1453}},{"target":{"file":"http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java","function":"JdkA2AHttpClient"},"deprecated":false,"digest":{"function_hash":"295403452416957750108743063401845981058","length":159},"id":"CVE-2026-111765-80e3e960","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"file":"extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java"},"deprecated":false,"digest":{"line_hashes":["213399846263700607997461089587486619850","179951681752006734857393557547484478251","238032432537527031585529865646259450757","163826175258965561233135566694255255124","141303278248532094255340893852055374909","316292319247770312751527653469059242518","257729207932247222581873981510446402727","283789631220245221678364563894921949974","307705946032963547156474381979816280519","164009931319422400786233146394541498357","45493963487914061500293497790974431734","339144871392046260161270840952911794343","328844865780091999594186804349095872663","78922032674487660298077738372703223721","36209194067681507928869605383354485864","252854182795845083497897964389003363278","124531847405550308635442687868086025217","14102334829723983729608608803365146667","18363361282130949151568811643382771220","148395009149383920287796005846680520809","110653229371282134902751324695349416135","287249354637766448267362474089423078862","151745325648299661666990645679402908252","201086275156111334603743356155620869700","329215998138531834047548971205512663453","205762411649050922372271570313381321133","239150048640693532591047479084631782945","79935300823819065265900240501419746611","39114056514763143012501445969632177521","61408529881255340535071761408545256176","241741974479514156078265796584052449062","220858394643618393248721810924705302778","248430572423532256165091994294569774220","152831659640430789880862465933754045242","315282978905793594207032146173571942114","88799228324334628623563396816642347695","83702548534771640808890894442051586295","325107451934605803102341888081462007682","228747478641483191822765390594373146592","85263495375182455150995556759922328592","19514720673695794684669278167919011963","268735869142952698545419352112586345920","290135717026761462244038348507324999866","236171568201832417557842178106920351688","313158082949425275281188126659208751548","263657529235772128920454583481498834100","48774957638057098857983922910887175733","296426346427701886810678109775625735747"],"threshold":0.9},"id":"CVE-2026-111765-82ef264f"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"function":"testCreateDelete","file":"extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java"},"deprecated":false,"digest":{"length":102,"function_hash":"55753744802451355982712723027102476360"},"id":"CVE-2026-111765-a06615ba"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","target":{"file":"client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java"},"deprecated":false,"digest":{"line_hashes":["233082241354066570813448180093819670417","146613175475215118537251510245469411173","15774516481402948509870276336299570947","258554781599943596587932212656245720056","162239936067183603071663074933724620488","114832741494531230118332557450602748253","101628560726868638954175422371894642219","108433354402844514891494839241727512323","111941993224402250006018159098537598176","184379370301342803592083431827670690387","97806109406974612948671596192975135163","76936459604836722745986499886038669367","125923826138995043487307218687981243491","281891372236640844937113543641842568745","52917372251392254278158590023034728279"],"threshold":0.9},"id":"CVE-2026-111765-a32a83f7"},{"source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"file":"extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java"},"deprecated":false,"digest":{"line_hashes":["126757262861640086018049024661608610743","154848449290269486029899532683063293180","251084407171788518344138576027514975996","30487012813861063774965718225290103530"],"threshold":0.9},"id":"CVE-2026-111765-a69b999e","signature_type":"Line","signature_version":"v1"},{"target":{"function":"testCreateGet","file":"extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java"},"deprecated":false,"digest":{"function_hash":"55753744802451355982712723027102476360","length":102},"id":"CVE-2026-111765-a98ab0b8","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5"},{"source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"file":"extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java","function":"testCreatePost"},"deprecated":false,"digest":{"length":102,"function_hash":"55753744802451355982712723027102476360"},"id":"CVE-2026-111765-be441256","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":216,"function_hash":"23321515973024461794923956713925120964"},"id":"CVE-2026-111765-c20524e4","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"file":"extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java","function":"testPostBuilderBody"}},{"target":{"function":"VertxA2AHttpClient","file":"extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java"},"deprecated":false,"digest":{"length":299,"function_hash":"136643808420365882585219459631823047475"},"id":"CVE-2026-111765-cec80433","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e"},{"target":{"file":"extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["231389643428590296426042642465525084377","249363147039955417974880535498988266821","61378049150606929969760405115593789989","27030440751668402900589919452818964942","75618214122361539488447013089492314856","124650563769334991951451263407296465881","194996251487368916396603178871700639946"]},"id":"CVE-2026-111765-d08e3c26","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e"},{"digest":{"line_hashes":["190876308099512679037918443197519236736","144160933694688363382547765301070970662","225493822003427586839351171994332203752","183912756549587952689511114997472179850","140619965956171028544829045994009294916","251084407171788518344138576027514975996","30487012813861063774965718225290103530","43283607287522130710827496291122705096","137025187115838383233197475513795204433","19439498327041117529365842558517140162","323893636633663391358502363111530826596","164082289449513199774621672518966731016"],"threshold":0.9},"id":"CVE-2026-111765-d51b155b","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"file":"extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java"},"deprecated":false},{"source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","target":{"file":"http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java"},"deprecated":false,"digest":{"line_hashes":["245742482994028127038437704544391496528","175726866628377098870546532950496783500","62342394797753697158268456211128393584","226290053579820591136528732899027207021","7982189781320667486145143998899980735","334107871806073291740050010324385845157","124610587703432544458055988641576024832","150232944257035412502272587491825079964","36174547811865391676333144921840164045","288904653404950321425403320164351444579","321746948696003236000636836599306757940","212653038377898875024045498531386350282"],"threshold":0.9},"id":"CVE-2026-111765-d9d903f3","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","target":{"file":"http-client/src/test/java/org/a2aproject/sdk/client/http/JdkA2AHttpClientTest.java"},"deprecated":false,"digest":{"line_hashes":["155299682180832588032612490062062615642","201325319216391341668983227266725458581","93427037518133832964013570325639844341","210978438851836314060804588182458286395","148687460831853927056049221581449796197","64032231061305092852525254820102302185","273719364734977194104309003190904281389","21545489602158548723775331680268300957","331563198584938231557986649328949715227","268144503770811296980129332407944020817","312453660338691992286523281239832902705","138643066134881581826174653917925082579","209349225168710373401391139522191740702","241588668747149887486518520857556142701","209154777742667184093909233198743368108","122412890985630319710904067457828202142","165184753435675369882798857639271534970","153638478100541104794550394461276030105","158534794015520075942630568095807670682"],"threshold":0.9},"id":"CVE-2026-111765-df23335d","signature_type":"Line"},{"digest":{"length":69,"function_hash":"272045000233190039896904590579289597358"},"id":"CVE-2026-111765-e3822a47","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"file":"extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java","function":"testNoArgsConstructor"},"deprecated":false},{"id":"CVE-2026-111765-f90d491c","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"file":"http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java"},"deprecated":false,"digest":{"line_hashes":["245742482994028127038437704544391496528","175726866628377098870546532950496783500","62342394797753697158268456211128393584","226290053579820591136528732899027207021","7982189781320667486145143998899980735","334107871806073291740050010324385845157","236678061425410507686932752132537148327","321746948696003236000636836599306757940","212653038377898875024045498531386350282","107489320168384616519800557603445468162","205906788606380793851594242487140587287","81391691370227519570143994578278807692","320310838678070424341685630952518154430","70994952049677248263767337586139194780","198852145301591440810657172889748770951","131416043116419955642222318338949575776","49767537532984505569644151779184337424","58032964630230657035139275799470262784","88017804841138347317367153280471755421","172333003790765443557561189273456525089","206604569758061916151280189959702890932","93373997931400278073617459532677349542","26614988055137727175808576874902067031","250018958848620982035713786262275264327","159151138745798042924816722269020699736"],"threshold":0.9}},{"source":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5","target":{"file":"extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java","function":"post"},"deprecated":false,"digest":{"function_hash":"58424083278079041392992952024131370027","length":261},"id":"CVE-2026-111765-fb31bacf","signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-21T09:36:47Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111765.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}