Description

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such manipulation leads to missing authorization. The attack can be launched remotely. Upgrading to version 1.3.0 is sufficient to resolve this issue. The name of the patch is e9a1abf9c90c02b16d17293afdc3cc2f555d63a6. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T21:17:42.363Z",
  "pubdate": "2026-09-14T21:17:42.363Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in a2aproject a2a-java version 1.2.0, specifically within the task listing request handler.\nThe vulnerability is categorized as a missing authorization flaw, which allows unauthorized remote attackers to retrieve information regarding tasks that should be restricted based on security policy.\nThe flaw resides within the AuthorizationRequestHandlerDecorator class, where improper validation logic fails to enforce access control checks for the onListTasks operation.\nThis vulnerability poses a significant risk to data confidentiality, as it enables unauthorized actors to enumerate and view system tasks without valid credentials or sufficient privileges.\nThe exploit can be triggered remotely without specific preconditions, making it a high-priority issue for any infrastructure utilizing the affected version of the a2a-java library.\nRemediation requires an upgrade to version 1.3.0, which includes the necessary logic corrections to ensure authorization is correctly applied to task-listing operations.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the AuthorizationRequestHandlerDecorator.onListTasks function to perform a mandatory authorization check before processing requests to list tasks.\nIn the affected version 1.2.0, the decorator pattern intended to wrap and secure the underlying request handlers fails to intercept and validate the security context during the task listing operation.\nWhen a remote user sends a request to the server, the component processes the call without verifying if the user has the requisite permissions, essentially bypassing the security layer designed to enforce role-based access control.\nThe attack flow begins when an attacker identifies the relevant endpoint serviced by the AuthorizationRequestHandlerDecorator. By crafting a request that invokes the onListTasks function, the attacker bypasses the internal authorization logic, causing the application to execute the task retrieval operation in an insecure, unauthenticated, or under-privileged context.\nThe lack of proper check mechanisms inside the file 'server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java' means the function proceeds to perform its task enumeration logic regardless of the caller's identity or authority.\nBecause the vulnerability exists at the decorator level, it effectively nullifies any subsequent security checks that might have been implemented in lower-level components if the decorator was intended to act as the primary gatekeeper.\nThe post-exploitation impact includes unauthorized information disclosure. An attacker can map the task infrastructure, gain insights into the application workflow, or potentially identify sensitive operational data associated with the returned tasks.\nExploitation requires no specialized local access, as the vulnerability is exposed remotely. The integrity of the application's authorization framework is compromised by this design failure, allowing any actor with network access to the target endpoint to elicit responses that should be restricted to authenticated administrative or user roles.\nPatch e9a1abf9c90c02b16d17293afdc3cc2f555d63a6 corrects this behavior by properly integrating the authorization verification logic within the onListTasks decorator method, ensuring that requests are validated against the established security policies before any data is returned to the client."
}