What happened
Verified via NVD REST (published Oct 20) and Tenable: CVE-2026-111764 (CVSS 7.5, CWE-862/1188, GHSA-qw47-mcm5-934w) — default InMemoryTaskStore treats a missing authorization provider as allow-all and get() never checks the caller; CVE-2026-111761 (CVSS 5.8) — BasePushNotificationSender POSTs task data to client-supplied URLs with no destination validation, scheme restrictions, or redirect bounds. Both fixed in 1.3.0.Final (Oct 20 advisory wave, per the aggregated coverage).
Why it matters
A2A is the emerging interop protocol for agent-to-agent communication; the default SDK behavior ships a cross-tenant task-read primitive (agent conversation history/artifacts) reachable with no authentication, plus a webhook SSRF that can reach cloud metadata from the agent server — both in the official reference implementation.
Attack vector
Network attacker supplies/guesses another caller's task ID against the default InMemoryTaskStore (authorizationProvider=null, get() does no owner check) to read task status, context ID, message history and artifacts; also registers a push destination via inline SendMessage / CreateTaskPushNotificationConfig so task updates are POSTed from the server's network position to internal/loopback/cloud-metadata addresses (redirects can convert POST to GET and DNS-rebinding defeats hostname checks).
Affected systems
org.a2aproject.sdk:a2a-java-sdk-server-common (official A2A Java SDK) < 1.3.0.Final (1.3.2.Final for Android client)
Mitigation
Upgrade to 1.3.0.Final (1.3.2.Final Android); wire a TaskAuthorizationProvider plus AuthorizationRequestHandlerDecorator; validate/allowlist push notification destinations; the advisory also fixes server-controlled-header-name credential leakage, clear-text push credential logging and Android X-API-Key redirect forwarding.