CVE-2026-111761 in a2a-java
Summary
by MITRE • 10/20/2026
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects. InMemoryPushNotificationConfigStore.setInfo stores the URL verbatim, and onCreateTaskPushNotificationConfig does not validate the destination. In the default deployment with push notifications enabled, an unauthenticated caller can register a destination through an inline SendMessage configuration or CreateTaskPushNotificationConfig for an existing task, causing task status and artifact updates to send requests from the server's network position to loopback, private, link-local cloud-metadata, IPv6 unique-local, unspecified, or multicast destinations where routing permits. JdkA2AHttpClient and VertxA2AHttpClient follow redirects, allowing a webhook redirect to bypass creation-time destination checks and convert a POST into a GET; hostname-only checks also do not prevent DNS rebinding. Direct POST delivery can push attacker-influenced task data into internal services, whereas a redirected POST-to-GET request drops the body. The sender discards the fetched response and does not expose delivery success or failure, so the demonstrated behavior does not provide response read-back. No credentials or user interaction are required. This issue is fixed in version 1.3.0.Final.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified within the A2A Java SDK prior to version 1.3.0.Final represents a critical server-side request forgery flaw rooted in insufficient input validation and URL handling mechanisms. The core technical deficiency lies in the BasePushNotificationSender class, which is responsible for transmitting task data via push notifications. This component fails to implement destination validation, scheme restrictions, or limits on HTTP redirects when processing URLs provided through TaskPushNotificationConfig. Furthermore, the InMemoryPushNotificationConfigStore.setInfo method stores these URLs verbatim without sanitization, and the onCreateTaskPushNotificationConfig function lacks any verification of the target destination. These oversights create a pathway for an attacker to manipulate outbound network requests originating from the server infrastructure itself.
From an operational perspective, this flaw allows unauthenticated actors to register malicious destinations through inline SendMessage configurations or by invoking CreateTaskPushNotificationConfig on existing tasks. Once configured, the system sends task status updates and artifact data to URLs controlled by the attacker. Because the SDK follows redirects via JdkA2AHttpClient and VertxA2AHttpClient, an initial request can be redirected from a public-facing endpoint to internal network addresses. This behavior enables access to loopback interfaces, private IP ranges, link-local networks, cloud metadata endpoints, IPv6 unique-local addresses, unspecified addresses, or multicast destinations where routing permits such traffic. The ability to redirect POST requests into GET requests further expands the attack surface by potentially bypassing content-type restrictions and dropping request bodies that might otherwise trigger server-side protections.
The security implications are severe as they align with CWE-918 Server-Side Request Forgery (SSRF) and specifically exploit weaknesses in URL parsing and validation, categorized under CWE-601 URL Redirection to Untrusted Site. The vulnerability also facilitates DNS rebinding attacks because hostname-only checks do not prevent resolution of malicious domains to internal IP addresses after the initial connection is established. An attacker can leverage this mechanism to probe internal services that are otherwise inaccessible from external networks. By pushing attacker-influenced task data into these internal endpoints, an adversary may attempt to trigger unintended actions or exfiltrate sensitive information contained within the task artifacts. Although the sender discards fetched responses and does not provide response read-back, limiting direct data leakage through this specific vector, the ability to interact with internal services can still lead to service disruption, unauthorized access via side-channel effects, or further exploitation of other vulnerabilities in backend systems that process these forged requests.
Mitigation strategies must prioritize strict input validation at all entry points where URLs are accepted. Developers should implement allow-listing for destination hosts and schemes rather than relying on blocklists which can be bypassed through encoding tricks or DNS rebinding. It is essential to disable automatic redirect following in HTTP clients used for internal communications, as this prevents attackers from chaining external redirects into internal targets. Additionally, implementing network-level controls such as egress filtering can restrict outbound connections from application servers to only known and necessary destinations. The vulnerability has been addressed in version 1.3.0.Final of the A2A Java SDK, which introduces proper validation mechanisms for push notification configurations. Organizations utilizing earlier versions should upgrade immediately to eliminate this risk vector and ensure that all external-facing components are hardened against SSRF attacks as recommended by industry standards like MITRE ATT&CK technique T1598.