{"id":"GHSA-9rhm-2h4x-jwmx","summary":"A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect","details":"*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an `APIKeySecurityScheme` specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows the redirect and forwards the custom header containing the credential, since only the standard `Authorization` header may be stripped on cross-origin redirects.\n\n**Where.** `client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java:69` in `intercept`\n\n**What.** The `apiKeySecurityScheme.name()` field from the remote agent's AgentCard (untrusted, server-controlled data) is used directly as the HTTP header name when placing client credentials. Combined with `JdkA2AHttpClient`'s `followRedirects(NORMAL)` policy, credentials under custom header names survive cross-origin redirects (only `Authorization` is stripped on newer JDKs), allowing a malicious agent to leak client credentials to third-party servers. Additionally, `AuthInterceptor` does not check that `location==HEADER` before placing the credential as a header.\n\n**Exploit scenario.** Client configures an API key credential for agent's security scheme `myAuth`. The malicious agent returns an AgentCard where `securitySchemes` includes `myAuth` as `APIKeySecurityScheme` with `name='X-Leaked-Cred'` and `location=HEADER`. `AuthInterceptor` places the credential in the `X-Leaked-Cred` header. The agent responds with HTTP 302 redirect to `https://evil.com/collect`. `JdkA2AHttpClient` follows the redirect, forwarding all custom headers including `X-Leaked-Cred` to `evil.com`. The attacker captures the client's credential.\n\n**Preconditions.**\n- Client application has configured API key credentials via `CredentialService` for the agent's security scheme\n- The agent is malicious or compromised (controls its own AgentCard response)\n- The default `JdkA2AHttpClient` is used (with `followRedirects=NORMAL`)\n- The JDK version does not strip custom headers on cross-origin redirects (all current versions)\n\n**Fix.** Validate the `APIKeySecurityScheme.name()` field against a whitelist of safe header names. Check that `apiKeySecurityScheme.location()` equals `Location.HEADER` before placing the credential as a header. Consider using `followRedirects(NEVER)` and implementing manual redirect handling that strips all authentication headers on cross-origin redirects.\n\n**Verification.** 2/3 lens verifiers confirmed.","aliases":["CVE-2026-111763"],"modified":"2026-10-21T03:11:56.125202083Z","published":"2026-10-20T21:04:16Z","related":["CVE-2026-111763","CVE-2026-111765"],"database_specific":{"github_reviewed_at":"2026-10-20T21:04:16Z","nvd_published_at":"2026-10-20T16:17:00Z","cwe_ids":["CWE-522"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/security/advisories/GHSA-4fpj-g9jf-9rgg"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/security/advisories/GHSA-9rhm-2h4x-jwmx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111763"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/pull/1097"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e"},{"type":"PACKAGE","url":"https://github.com/a2aproject/a2a-java"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final"}],"affected":[{"package":{"name":"org.a2aproject.sdk:a2a-java-sdk-parent","ecosystem":"Maven","purl":"pkg:maven/org.a2aproject.sdk/a2a-java-sdk-parent"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0.Final"}]}],"versions":["1.0.0.Alpha4","1.0.0.Beta1","1.0.0.CR1","1.0.0.Final","1.1.0.Final","1.2.0.Final"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9rhm-2h4x-jwmx/GHSA-9rhm-2h4x-jwmx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}