Critical Gemini CLI A2A Server Flaw: Unauthenticated Command Execution
herdiyana256 · ghdev · 2026-08-05
This PR addresses multiple critical security vulnerabilities in the Gemini CLI A2A (Agent-to-Agent) server.
- Missing Authentication: Custom REST routes (e.g., /tasks, /executeCommand) and certain JSON-RPC methods completely bypassed authentication, allowing attackers to invoke endpoints without any credentials.
- Path Traversal: RestoreCommand failed to validate file paths, enabling attackers to read checkpoint files from other projects on the host via crafted paths, exposing full conversation and tool-call histories.
- Fix: Enforces an authentication middleware ahead of all routes using constant-time comparison and patches path validation.
More from coding & agent
- Opinion: AI Coding is Manageable, but AI Workflows Risk Becoming Slop Without QA — oran_ge · 2026-08-05
- /human-review: Give AI Feedback Like Editing a Google Doc — petergyang · 2026-08-05
- Developer Recreates Pacman Entirely from AI-Generated Binary Code — Dimillian · 2026-08-05
- Rethinking MCP: The 'Build It and They Will Come' Trap — Warm-Reaction-456 · 2026-08-05
- Shredly Launches MCP as a Service to Turn APIs into Hosted Servers — localhost9393 · 2026-08-05
- Claude Code Skills Silently Execute Commands by Default, Enabling File Injection — dbreunig · 2026-08-05