{"id":"GHSA-4fpj-g9jf-9rgg","summary":"A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix","details":"The GHSA-9rhm fix added this safe setting in\nAndroidA2AHttpClient.createConnection():\n\n    connection.setInstanceFollowRedirects(false);\n\nThe synchronous POST builder later overwrites it:\n\n    private boolean followRedirects = true;\n\n    public A2AHttpResponse post() throws IOException {\n        HttpURLConnection connection = createConnection(\"POST\", false);\n        connection.setInstanceFollowRedirects(followRedirects);\n        // ...\n    }\n\nThe second assignment wins. JSONRPCTransport and RestTransport both\nadd interceptor-produced headers and call synchronous post() without\nsetting followRedirects(false).\n\nOn Android's repackaged OkHttp implementation, a cross-authority\nredirect strips Authorization but retains nonstandard request headers.\nAuthInterceptor permits four nonstandard authentication header names:\n\n    X-API-Key\n    API-Key\n    X-Auth-Token\n    X-Authentication\n\nI confirmed that the exact v1.3.1.Final Maven artifact forwards\ncomplete synthetic values under all four names to a second loopback\nauthority. I also reproduced the supported AuthInterceptor to Android\nPOST path. Explicitly calling followRedirects(false) returns the\noriginal 302 and produces no request to the collector.\n\nAll test traffic stayed on two ephemeral 127.0.0.1 listeners. All\ncredentials were synthetic FULCRUM-SYNTHETIC-* values.\n\nReproduction\n\nI have attached AndroidA2AHttpClientRedirectTest.java. Copy it to:\n\n    extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/\n\nRun:\n\n    mvn -pl extras/http-client-android -am \\\n      -Dtest=AndroidA2AHttpClientRedirectTest \\\n      -Dsurefire.failIfNoSpecifiedTests=false test\n\nOn unpatched current main, the default test fails with:\n\n    Android synchronous POST must retain the documented no-redirect default\n    expected: \u003c302\u003e but was: \u003c200\u003e\n\nThe explicit followRedirects(true) control still passes.\n\nThe separate exact-artifact fixture passed three consecutive runs. Its\nrelevant output was:\n\n    default status=200 x-api-key=FULCRUM-SYNTHETIC-DIRECT\nauthorization=null method=GET\n    control-followRedirects-false status=302 collectorHits=0\n    interceptor-chain status=200\nx-api-key=FULCRUM-SYNTHETIC-INTERCEPTOR collectorHits=1\n    header-matrix name=X-API-Key forwarded=FULCRUM-SYNTHETIC-X-API-Key\n    header-matrix name=API-Key forwarded=FULCRUM-SYNTHETIC-API-Key\n    header-matrix name=X-Auth-Token forwarded=FULCRUM-SYNTHETIC-X-Auth-Token\n    header-matrix name=X-Authentication\nforwarded=FULCRUM-SYNTHETIC-X-Authentication\n\nImpact and limitations\n\nThe demonstrated impact is disclosure of a complete API key or\nauthentication token to a different authority. I am not claiming\nsubsequent use of the credential, integrity impact, availability\nimpact, code execution, or host compromise.\n\nA fully malicious origin already receives the credential on the first\nrequest. The additional boundary matters most when redirect or\nfront-door behavior is compromised separately from the component that\nhandles request credentials, or when different parts of the origin\noperate in different trust domains.\n\nThe 7.5 score applies to an autonomous client where no human action is\nneeded after the remote endpoint returns the redirect. If the Android\nworkflow requires a person to select or invoke the remote agent, UI:R\ngives a 6.5 score. I have kept both vectors because that deployment\ndetail affects severity but not the underlying behavior. These are\nsuggested scores, consistent with the policy's statement that actual\nCVSS depends on the specific deployment context. The same policy\nlabels the parent credential-redirect property as moderate.\n\nScope and prior art\n\nThis path appears to fall directly under the project's current security model:\n\n1. extras/http-client-android and the client transports are listed as in scope.\n2. Remote AgentCard and response data are treated as attacker-relevant inputs.\n3. A malicious or compromised remote agent is part of the client-side\nadversary model.\n4. Section 8 says automatic redirects are disabled in all JDK, Vert.x,\nand Android implementations to prevent credential leakage.\n5. Section 13 defines a violation of a Section 8 property through the\ncovered input and adversary as VALID.\n6. Section 13a lists missed call sites and under-strength mitigations\nas new findings after an incomplete fix.\n7. Section 14 records the original issue as fixed by disabling\nredirects across all HTTP client implementations. The Android\nsynchronous path directly contradicts that recorded repair state.\n\nThis report does not claim that an AgentCard SecurityScheme\ndeclaration enforces authentication. The application has already\nconfigured the credential, and the shipped AuthInterceptor places it\nin an allowed header. The failure is the Android client's default\nredirect behavior after that point. It does not depend on a custom\nSPI, an insecure configuration flag, a test-only component,\nserver-side authentication, or any of the recurring non-findings\nlisted in Section 11a.\n\nGHSA-9rhm is the direct parent finding. Its fix commit says redirects\nwere disabled across all clients, but the Android POST-level override\nremains in 1.3.0.Final, 1.3.1.Final, and current main. I searched the\npublic issues and pull requests on September 5 and found PR #1097, but\nno report covering this surviving synchronous Android path. The other\nthree published advisories address server authorization defaults,\npush-notification SSRF, and credential logging. They do not cover this\nAndroid client path.\n\nSuggested fix\n\nThe smallest compatible change is:\n\n    - private boolean followRedirects = true;\n    + private boolean followRedirects = false;\n\nThis keeps followRedirects(true) available as an explicit opt-in. The\nattached regression passes three out of three times after the change.\nThe Android module and its reactor dependencies pass 455 tests with no\nfailures. The full repository test run passes 2,914 tests with no\nfailures or errors. It reports 127 skips when using the project's\ndocumented -DskipDockerTests=true option inside the isolated build\ncontainer.\n\nReferences\n\nSecurity property:\nhttps://github.com/a2aproject/a2a-java/blob/30e31086e24bea096b5f662088661269c9119100/SECURITY.md#L335-L342\n\nTriage and incomplete-fix rules:\nhttps://github.com/a2aproject/a2a-java/blob/30e31086e24bea096b5f662088661269c9119100/SECURITY.md#L547-L573\n\nAndroid documentation:\nhttps://github.com/a2aproject/a2a-java/blob/30e31086e24bea096b5f662088661269c9119100/docs/content/dev/security.md#L60-L74\n\nSafe connection setting and later POST override:\nhttps://github.com/a2aproject/a2a-java/blob/30e31086e24bea096b5f662088661269c9119100/extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java#L95-L114\nhttps://github.com/a2aproject/a2a-java/blob/30e31086e24bea096b5f662088661269c9119100/extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java#L269-L300\n\nAuthInterceptor allowlist and credential injection:\nhttps://github.com/a2aproject/a2a-java/blob/30e31086e24bea096b5f662088661269c9119100/client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java#L33-L46\nhttps://github.com/a2aproject/a2a-java/blob/30e31086e24bea096b5f662088661269c9119100/client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java#L85-L90\n\nParent advisory and fix:\nhttps://github.com/a2aproject/a2a-java/security/advisories/GHSA-9rhm-2h4x-jwmx\nhttps://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e\n\nAndroid redirect implementation:\nhttps://android.googlesource.com/platform/external/okhttp/+/05b3c271102f7e16bd772dd8a9dab5c6b1424c24/repackaged/okhttp/src/main/java/com/android/okhttp/internal/http/HttpEngine.java#900","aliases":["CVE-2026-111765"],"modified":"2026-10-21T03:11:56.305391879Z","published":"2026-10-20T21:08:06Z","related":["CVE-2026-111763","CVE-2026-111765"],"database_specific":{"cwe_ids":["CWE-522"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-10-20T21:08:06Z","nvd_published_at":"2026-10-20T16:17:00Z"},"references":[{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/security/advisories/GHSA-4fpj-g9jf-9rgg"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/security/advisories/GHSA-9rhm-2h4x-jwmx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111765"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/pull/1141"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/commit/3ae82912a106a6765d7b78042b0ef96e6c2e29b5"},{"type":"PACKAGE","url":"https://github.com/a2aproject/a2a-java"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/blob/30e31086e24bea096b5f662088661269c9119100/SECURITY.md#L335-L342"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/releases/tag/v1.3.2.Final"}],"affected":[{"package":{"name":"org.a2aproject.sdk:a2a-java-sdk-http-client-android","ecosystem":"Maven","purl":"pkg:maven/org.a2aproject.sdk/a2a-java-sdk-http-client-android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0.Final"},{"fixed":"1.3.2.Final"}]}],"versions":["1.3.0.Final","1.3.1.Final"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.3.1.Final","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4fpj-g9jf-9rgg/GHSA-4fpj-g9jf-9rgg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}