CVE-2026-90820: a2aproject a2a-java Auth Bypass Vulnerability

CVE-2026-90820 Overview

CVE-2026-90820 is a missing authorization vulnerability [CWE-862] in the a2aproject a2a-java SDK version 1.2.0. The flaw resides in the AuthorizationRequestHandlerDecorator.onListTasks function within server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. The decorator failed to invoke a list-scoped read authorization check before delegating to the task store. Remote authenticated attackers can enumerate task listings without proper authorization checks. The maintainers resolved the issue in version 1.3.0.Final through commit e9a1abf9c90c02b16d17293afdc3cc2f555d63a6.

Critical Impact
Authenticated remote users can invoke the listTasks operation and receive task data that should have been gated by an authorization provider, resulting in unauthorized information exposure through the a2a-java server API.

Affected Products

a2aproject a2a-java version 1.2.0
Component: server-common module, AuthorizationRequestHandlerDecorator class
Downstream applications embedding the a2a-java server SDK prior to 1.3.0.Final

Discovery Timeline

2026-09-14 - CVE-2026-90820 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90820

Vulnerability Analysis

The a2a-java SDK implements an authorization decorator pattern around its request handlers. Each handler method is expected to consult an AuthorizationProvider before executing sensitive operations such as reading, writing, or creating tasks. In version 1.2.0, the onListTasks handler bypassed this gate entirely at the list scope. The decorator instead relied solely on the TaskStore to filter individual entries via checkRead calls during iteration.

This design decision meant that any caller who could reach the endpoint could invoke LIST_TASKS, regardless of whether the authorization provider would deny the operation at the collection level. Even when per-task filtering removed entries, the operation itself was never rejected outright. Environments that expected list-level denial to prevent enumeration were exposed to unauthorized calls.

Root Cause

The root cause is a missing authorization check on the list-scoped operation. Unlike onGetTask and other single-object handlers that call enforceRead(context, params.id(), TaskOperation.GET_TASK), onListTasks had no equivalent pre-delegation check. The LIST_TASKS operation has no single task identifier to key on, so the original implementation deferred all filtering to the store layer.

Attack Vector

The attack requires network access and low-level authenticated privileges. An attacker with valid credentials sends a listTasks request to the a2a-java server. The decorator forwards the request to the store without a list-scope authorization check. The store applies per-task filtering, but the operation itself is never denied, allowing enumeration attempts against the endpoint.

java

// Patch: introduces a list-scoped read check before delegation
private static final String LIST_TASKS_SCOPE_ID = "";

private void enforceListRead(ServerCallContext context) throws A2AError {
    if (authorizationProvider != null
            && !authorizationProvider.checkRead(context, LIST_TASKS_SCOPE_ID, TaskOperation.LIST_TASKS)) {
        throw new TaskNotFoundError();
    }
}

@Override
public Task onGetTask(TaskQueryParams params, ServerCallContext context) throws A2AError {
    enforceRead(context, params.id(), TaskOperation.GET_TASK);
    // ...
}
// Source: https://github.com/a2aproject/a2a-java/commit/e9a1abf9c90c02b16d17293afdc3cc2f555d63a6

The patch adds enforceListRead, which invokes the authorization provider with an empty-string sentinel representing the whole list scope. A null task ID would break providers keying lookups on the identifier, so the sentinel string was chosen deliberately. If the provider denies the request, the decorator throws TaskNotFoundError rather than leaking whether the resource exists.

Detection Methods for CVE-2026-90820

Indicators of Compromise

Unexpected listTasks or LIST_TASKS operation invocations in a2a-java server access logs from principals not authorized for collection-level reads.
Elevated volume of listTasks requests from a single authenticated identity indicating enumeration behavior.
Application logs showing successful onListTasks responses without a corresponding authorization provider decision entry.

Detection Strategies

Inventory Java services and Maven or Gradle dependencies for a2a-java version 1.2.0 using software composition analysis tooling.
Instrument the AuthorizationRequestHandlerDecorator class with logging that records every entry into onListTasks alongside the calling principal.
Compare LIST_TASKS request volume against per-task checkRead denials to identify callers repeatedly probing filtered listings.

Monitoring Recommendations

Forward a2a-java server access and authorization logs to a centralized SIEM for correlation with identity telemetry.
Alert on any listTasks invocations from service accounts or user identities that lack an explicit list-scope grant.
Track deployment versions of the server-common module across environments to confirm patched builds are running.

How to Mitigate CVE-2026-90820

Immediate Actions Required

Upgrade a2a-java to version 1.3.0.Final or later across all server deployments that embed the SDK.
Audit AuthorizationProvider implementations to confirm they handle the empty-string LIST_TASKS_SCOPE_ID sentinel introduced by the patch.
Review recent listTasks invocation history to identify potentially unauthorized enumeration of task metadata.

Patch Information

The fix landed in commit e9a1abf9c90c02b16d17293afdc3cc2f555d63a6 through GitHub Pull Request #1038 and shipped in GitHub Release v1.3.0.Final. The patch adds an enforceListRead call at the top of onListTasks that consults the authorization provider before delegation. See the GitHub Commit e9a1abf diff for full context.

Workarounds

If upgrading is not immediately feasible, wrap the onListTasks handler in an application-level filter that rejects unauthorized principals before the SDK is invoked.
Restrict network access to the a2a-java server endpoint to trusted service identities using an API gateway or service mesh policy.
Deploy custom TaskStore implementations that deny list operations entirely for principals lacking a collection-scope grant.

bash

# Maven dependency update example
# Replace 1.2.0 with 1.3.0.Final in pom.xml
mvn versions:use-dep-version -Dincludes=io.a2a:a2a-java-sdk-server-common -DdepVersion=1.3.0.Final -DforceVersion=true
mvn clean verify