A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 3
- StatusPublished → DeferredNVD modified 2026-10-27 14:52
- StatusReceived → PublishedNVD modified 2026-10-26 19:30
- First seenCVSS 6.9NVD modified 2026-10-26 20:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 8
- https://github.com/a2aproject/a2a-go/
- https://github.com/a2aproject/a2a-go/commit/f4d588216b0c9520e94d571bab725c38ce23064c
- https://github.com/a2aproject/a2a-go/pull/393
- https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0
- https://vuldb.com/cve/CVE-2026-116478
- https://vuldb.com/submit/1014887
- https://vuldb.com/vuln/426391
- https://vuldb.com/vuln/426391/cti