The vulnerability enables the A2A Java SDK to send HTTP requests to arbitrary URLs specified in push‑notification configurations without validating the destination, scheme, or redirect behavior. An attacker can thus trigger the server to contact internal or private endpoints, including loopback, metadata services, link‑local and multicast addresses, potentially leaking information or enabling further internal access. The flaw does not provide a response for verification, but the ability to cause outbound traffic remains significant from an attacker's perspective.

A2A Java SDK exposed by a2aproject a2a-java is vulnerable in all releases prior to version 1.3.0.Final. Any deployment with push‑notification delivery enabled that has not applied the 1.3.0.Final release is affected.

The CVSS v3.1 score of 5.8 indicates a medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires an unauthenticated caller to create or modify a push‑notification configuration for an existing task or to send a message via an inline SendMessage payload. Once in place, the attacker can direct the server to reach internal or private network resources without credentials or user interaction, making the attack realistic in environments where such configuration endpoints are reachable from the network.