Detections
Analytics

SCA: security update for org.a2aproject.sdk:a2a-java-sdk-server-common (GHSA-qw47-mcm5-934w)

high Tenable Cloud Security Plugin ID 476411

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the
 default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument
 constructor sets authorizationProvider to null, and InMemoryTaskStore.get(String taskId) returns the
 stored task without checking the caller or owner. Authorization depends on supplying a
 TaskAuthorizationProvider and routing requests through AuthorizationRequestHandlerDecorator, whether
 installed through CDI or explicitly by the application. Default store wiring and manually constructed
 DefaultRequestHandler.builder().build() handlers, including integrations such as Spring, leave task reads
 unprotected when no effective authorization-provider and decorator check is installed. In a multi-caller
 deployment using the default configuration, a caller who knows or guesses another caller's task ID can
 retrieve the task status, context ID, message history, and artifacts. The default/reference transport
 endpoints do not enforce authentication, so the task-read disclosure is reachable by an unauthenticated
 caller rather than requiring a privileged account. This issue is fixed in version 1.3.0.Final.
 (CVE-2026-111764)

Solution

Update the org.a2aproject.sdk:a2a-java-sdk-server-common library and its related packages to version 1.3.0.Final or later.

See Also

https://github.com/advisories/GHSA-qw47-mcm5-934w

Plugin Details

Severity: High

ID: 476411

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/21/2026

Updated: 10/21/2026

Risk Information

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-111764

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/20/2026

Vulnerability Publication Date: 10/20/2026

Reference Information

CVE: CVE-2026-111764