## A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

- 種別: advisory
- 重大度: medium
- 関連技術: java
- CVE: CVE-2026-111761
- 公開日時: 2026-10-20T21:06:22.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-q78c-5jjq-57g8)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-q78c-5jjq-57g8

影響: maven:org.a2aproject.sdk:a2a-java-sdk-server-common < 1.3.0.Final → 1.3.0.Final
--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common (push-notification delivery) - Affected versions: /latest/meta-data/iam/security-credentials/. Use returnImmediately: true, header A2A-Version: 1.0, and role ROLE_USER. The URL is stored verbatim. (Equivalent via CreateTaskPushNotificationConfig on an existing task.) 3. As the task emits state/artifact updates, the sender POSTs each one to the stored URL, from the server's own network position: POST /latest…