{"id":"ghsa-ghsa-q78c-5jjq-57g8","seq":2376,"kind":"advisory","title":"A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery","url":"https://github.com/advisories/GHSA-q78c-5jjq-57g8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-q78c-5jjq-57g8","summary":"影響: maven:org.a2aproject.sdk:a2a-java-sdk-server-common < 1.3.0.Final → 1.3.0.Final\n--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common (push-notification delivery) - Affected versions: /latest/meta-data/iam/security-credentials/. Use returnImmediately: true, header A2A-Version: 1.0, and role ROLE_USER. The URL is stored verbatim. (Equivalent via CreateTaskPushNotificationConfig on an existing task.) 3. As the task emits state/artifact updates, the sender POSTs each one to the stored URL, from the server's own network position: POST /latest…","severity":"medium","techs":["java"],"cves":["CVE-2026-111761"],"tags":["GHSA-q78c-5jjq-57g8","org.a2aproject.sdk:a2a-java-sdk-server-common"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T21:06:22.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}