CVE-2026-111764

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships._ --- - **Ecosystem:** Maven - **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (task store / authorization) - **Affected versions:** `<= 1.2.0.Final` (and `1.2.1.Final-SNAPSHOT` on `main` prior to the fix) - **Patched version:** _(the release that carries the fix, e.g. 1.2.1.Final)_ - **CWE:** CWE-1188 (Insecure Default Initialization), CWE-862 (Missing Authorization) - **Severity:** High - **CVSS v3.1:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` (7.5, High) --- ## Details The default task store performs no authorization on task reads. `InMemoryTaskStore`'s no-arg constructor sets `authorizationProvider = null`, and `InMemoryTaskStore.get(String taskId)` is a bare map lookup with no authorization check regardless of provider: ```java public InMemoryTaskStore() { this.authorizationProvider = null; // default wiring } @Override public @Nullable Task get(String taskId) { return tasks.get(taskId); // no owner / caller check } ``` Authorization is enforced only when the application both supplies a `TaskAuthorizationProvider` *and* routes requests through `AuthorizationRequestHandlerDecorator` (via CDI), which checks ownership before delegating. A server that uses the default store, or wires `DefaultRequestHandler.builder().build()` manually, or integrates through a non-CDI stack (e.g. Spring), never reaches that check. The safe posture is therefore opt-in and the shipped default is the unsafe one. A caller can read a task created by another caller simply by knowing or guessing its id. ## Summary With the SDK's default configuration, task reads are not authorized: any caller can retrieve a task (including its status, context, message history, and artifacts) created by another caller, by supplying the task id.