A2A Java SDK inadvertently uses a header name derived from the remote AgentCard to transport an API key when the client is configured through CredentialService. The header name is not validated for location, so a malicious or compromised agent can trick the SDK into forwarding the key to a third‑party server. This is a credential exposure flaw, identified as CWE‑522. The exposed key can be used by any party that receives the redirected request, potentially allowing unauthorized access to the target system.

The vulnerability exists in all releases of the A2A Project A2A Java SDK before version 1.3.0.Final. Users of the SDK who compile or distribute earlier versions are at risk unless they take mitigations. There is no other affected product listed.

The CVSS score of 5.7 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control the remote agent’s AgentCard and craft a redirect response; no additional client privileges are needed. If an attacker can achieve this, they may redirect the request to a malicious server and obtain the API key. Because the conditions are specific and control of the remote agent is required, the likelihood of widespread exploitation is low, but the impact is significant once achieved.