{"action":"Upgrade org.a2aproject.sdk:a2a-java-sdk-parent to 1.3.0.Final or later.","affected":[{"fixed":"1.3.0.Final","introduced":"0"}],"component":"org.a2aproject.sdk:a2a-java-sdk-parent","cve_ids":["CVE-2026-111763"],"ecosystem":"Maven","epss":0.00141,"exploited":false,"fixed_versions":["1.3.0.Final"],"ghsa_id":"GHSA-9rhm-2h4x-jwmx","id":"tcs_01M5N8QNQJZKQFBMJNWT8P3232","modified_at":"2026-10-21T03:11:56.125202083Z","published_at":"2026-10-20T21:04:16Z","references":["https://osv.dev/vulnerability/GHSA-9rhm-2h4x-jwmx","https://github.com/a2aproject/a2a-java/security/advisories/GHSA-4fpj-g9jf-9rgg","https://github.com/a2aproject/a2a-java/security/advisories/GHSA-9rhm-2h4x-jwmx","https://nvd.nist.gov/vuln/detail/CVE-2026-111763","https://github.com/a2aproject/a2a-java/pull/1097","https://github.com/a2aproject/a2a-java/commit/2a36530d75e11bcf9b81f543464dbe193ca6478e","https://github.com/a2aproject/a2a-java","https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-9rhm-2h4x-jwmx","url":"https://osv.dev/vulnerability/GHSA-9rhm-2h4x-jwmx"},{"source":"nvd","source_id":"CVE-2026-111763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111763"}],"summary":"A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect"}