{"items":[{"id":"NVI-00011797","kind":"vulnerability","title":"A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-x32g-jvvm-4725","CVE-2026-111762"],"plain_summary":"GitHub lists this reviewed advisory for org.a2aproject.sdk:a2a-java-sdk-transport-rest. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-300f56a4a67c043b3dcee21ec8bc646a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-300f56a4a67c043b3dcee21ec8bc646a","url":"https://github.com/advisories/GHSA-x32g-jvvm-4725","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-x32g-jvvm-4725","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:39.183Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-300f56a4a67c043b3dcee21ec8bc646a"],"technology":"org.a2aproject.sdk:a2a-java-sdk-transport-rest","known_exclusions":[],"conditions_summary":"### *Impact.** Push notification bearer tokens and authentication credentials submitted by clients are written to server log files in cleartext. Any operator, log aggregation system, or attacker with log access can read these secrets and use them to authenticate to the client's push notification endpoints, potentially sending forged task status updates.\n\n**Where.** `transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java:676` in `parseRequestBody`\n\n**What.** The `parseRequestBody` method logs the entire JSON request body at `SEVERE` level when `JsonFormat.parser().merge()` throws `InvalidProtocolBufferException`. This method is called from `createTaskPushNotificationConfiguration` (line 377), where the body contains client-supplied push notification bearer tokens (field `token`) and authentication credentials (field `authentication.credentials`). These secrets are written to server log files in full.\n\n**Exploit scenario.** A client creates a push notification configuration by POSTing to `/v1/tenants/{tenant}/tasks/{taskId}/pushNotificationConfigs` with a body containing `{\"url\": \"https://client.example.com/webhook\", \"token\": \"secret-bearer-token\", \"a","public_affected_ranges":["< 1.3.0.Final"]}],"null_published_at":"2026-11-01T01:03:56.605Z","source_updated_at":"2026-10-20T21:08:34.000Z","source_disclosed_at":"2026-10-20T21:08:33.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:39.183Z"}],"next_cursor":null,"snapshot_revision":"42594"}