a2aproject a2a-java up to 1.2.x RestHandler RestHandler.java RestHandler.parseRequestBody information exposure

Summaryinfo

A vulnerability classified as problematic has been found in a2aproject a2a-java up to 1.2.x. This impacts the function RestHandler.parseRequestBody of the file transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java of the component RestHandler. This manipulation causes information exposure. This vulnerability is tracked as CVE-2026-111762. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in a2aproject a2a-java up to 1.2.x. It has been declared as problematic. Affected by this vulnerability is the function RestHandler.parseRequestBody of the file transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java of the component RestHandler. The manipulation with an unknown input leads to a information exposure vulnerability. The CWE definition for the vulnerability is CWE-209. The product generates an error message that includes sensitive information about its environment, users, or associated data. As an impact it is known to affect confidentiality. The summary by CVE is:

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in `transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java` logs the entire JSON request body at SEVERE level when JsonFormat.parser().merge() throws InvalidProtocolBufferException. With push notifications enabled, createTaskPushNotificationConfiguration reaches this parser for requests to `/v1/tenants/{tenant}/tasks/{taskId}/pushNotificationConfigs`, whose token and authentication.credentials fields can contain bearer tokens and authentication credentials for client push endpoints. A valid JSON body that fails protobuf deserialization, including an unknown field under strict parsing or a schema mismatch, causes those secrets to be written to the server logs in cleartext. An attacker with access to the server logs or a log aggregation system can retrieve the credentials and potentially use the credentials to send forged task status updates to the client's push notification endpoint. This issue is fixed in version 1.3.0.Final.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-111762 since 10/16/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 1.3.0.Final eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-105044). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• a2aproject

Name

• a2a-java

Version

• 1.0
• 1.1
• 1.2

Website

• Product: https://github.com/a2aproject/a2a-java/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion