Skip to content
OpenAdvisories

Package · Maven

org.a2aproject.sdk:a2a-java-sdk-server-common

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2026-111764

    A2A Java SDK has a fail-open default task authorization

    A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTa…

    a2aproject a2a-java org.a2aproject.sdk:a2a-java-sdk-server-common Maven
  • Medium 5.8
    CVE-2026-111761

    A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

    A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds…

    a2aproject a2a-java org.a2aproject.sdk:a2a-java-sdk-server-common Maven