High github · GHSA-qw47-mcm5-934w

A2A Java SDK has a fail-open default task authorization

Published Oct 20, 2026 CVSS 7.5

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships._

Ecosystem: Maven
Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common (task store / authorization)
Affected versions: `

Affected AI Products

a2a

View original source

Get the weekly digest. Every Monday: top AI security stories of the week. Free.