CVE-2026-90820 in a2a-java
Summary
by MITRE • 09/15/2026
A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such manipulation leads to missing authorization. The attack can be launched remotely. Upgrading to version 1.3.0 is sufficient to resolve this issue. The name of the patch is e9a1abf9c90c02b16d17293afdc3cc2f555d63a6. The affected component should be upgraded.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The a2aproject a2a-java library, specifically version 1.2.0, contains a critical security flaw within its server-side request handling mechanism that results in missing authorization controls. This vulnerability is located in the AuthorizationRequestHandlerDecorator class, which serves as an intermediary layer for processing authentication and authorization requests within the A2A protocol implementation. The specific point of failure resides in the onListTasks method found in the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. This function is responsible for managing lists of tasks, a core operational feature that requires strict access control to ensure data integrity and confidentiality.
The technical nature of this flaw constitutes an authorization bypass where the system fails to properly validate whether the requesting entity possesses the necessary permissions before executing the task listing operation. In a secure implementation, every request to sensitive endpoints must be intercepted by an authentication check followed by an authorization verification against defined access control policies. However, in version 1.2.0, this validation step is either omitted or incorrectly implemented within the onListTasks handler. Consequently, any client that can reach the server endpoint associated with this function can retrieve task information without providing valid credentials or possessing the required role-based permissions. This represents a fundamental breakdown in the principle of least privilege and proper access control enforcement.
From an operational perspective, this vulnerability allows for remote exploitation by unauthenticated attackers. Since the flaw resides on the server side and involves network-accessible endpoints, an adversary does not need local system access or prior authentication to launch an attack. The impact includes unauthorized disclosure of sensitive task data, which may contain proprietary information, user-specific details, or operational metadata critical to business processes. Depending on the sensitivity of the tasks managed by the application, this exposure could lead to significant confidentiality breaches and potentially facilitate further attacks such as social engineering or targeted exploitation based on revealed system states. This aligns with CWE-287, which describes Improper Authentication, and more specifically CWE-862, Missing Authorization, indicating a failure in access control logic that permits actions without proper permission checks.
The attack vector is classified as remote, meaning it can be exploited over a network such as the internet or an internal corporate LAN without requiring physical proximity to the target system. This broad accessibility increases the risk profile significantly, as automated scanning tools and opportunistic attackers frequently probe for services exposing unauthenticated endpoints that leak sensitive data. The lack of authentication requirements effectively turns this endpoint into an open information disclosure channel, undermining the security posture of any application relying on a2a-java 1.2.0 for its task management infrastructure.
To mitigate this vulnerability, immediate remediation is required by upgrading the affected component to version 1.3.0 or later. The development team has addressed this issue in patch e9a1abf9c90c02b16d17293afdc3cc2f555d63a6, which corrects the authorization logic within the AuthorizationRequestHandlerDecorator.onListTasks method. This update ensures that all requests to list tasks are properly authenticated and authorized before any data is returned. Organizations utilizing this library should prioritize updating their dependencies in both development and production environments to prevent unauthorized access. Additionally, it is recommended to implement defense-in-depth strategies such as network-level firewalls and API gateways that enforce authentication at the perimeter layer, providing an additional safeguard against similar implementation flaws in future updates or other components within the ecosystem.