{"id":"CVE-2026-113704","kind":"vulnerability","aliases":["CVE-2026-113704"],"related":[],"title":"a2a-rs: push notification config enables server-side request forgery remotely","description":"A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.","summary":"The HttpPushSender in a2a-rs up to 0.4.3 accepts a TaskPushNotificationConfig argument that is not validated, so an attacker can make the server send HTTP requests to destinations of their choosing. This is server-side request forgery, which can reach internal services the server can see.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a2a","a2a-rs","package","rust","self-hosted"],"not_affected_if":["no-a2a-rs-server","no-push-notifications"],"how_to_check":"- Check the a2a-rs version in `Cargo.lock` for the `a2a-rs` crate; versions up to `0.4.3` are affected.\n- Look for use of push notifications in `crates/server/src/push_notification_sender.rs` in the project.","fix":"- Move the `a2a-rs` crate to a version later than `0.4.3` that includes patch `2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224`.\n- Until upgraded, disable or restrict push notification configuration for untrusted callers.","status":"open","published_at":"2026-10-20T22:19:29+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:18:55+00:00","updated_at":"2026-10-25T03:18:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:18:55Z","model":"claude-haiku-5-5","output":{"fix":"- Move the `a2a-rs` crate to a version later than `0.4.3` that includes patch `2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224`.\n- Until upgraded, disable or restrict push notification configuration for untrusted callers.","reach":"internet","title":"a2a-rs: push notification config enables server-side request forgery remotely","impact":"medium","summary":"The HttpPushSender in a2a-rs up to 0.4.3 accepts a TaskPushNotificationConfig argument that is not validated, so an attacker can make the server send HTTP requests to destinations of their choosing. This is server-side request forgery, which can reach internal services the server can see.","category":"package","nicknames":[],"who_cares":["a2a-rs","rust","self-hosted","a2a"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server makes attacker-chosen requests, reaching internal services","analyst_note":"Confirm the fixed version and whether authentication is required to set push notification config, via the NVD entry and the linked upstream commit.","how_to_check":"- Check the a2a-rs version in `Cargo.lock` for the `a2a-rs` crate; versions up to `0.4.3` are affected.\n- Look for use of push notifications in `crates/server/src/push_notification_sender.rs` in the project.","needs_analyst":true,"not_affected_if":["no-push-notifications","no-a2a-rs-server"],"who_is_affected":"Teams running an A2A server built on a2a-rs up to 0.4.3 that accepts push notification configuration from remote clients are exposed, because the server will fetch the URL they supply. Deployments that do not expose push notification features to untrusted callers, or that run no a2a-rs server, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000668,"input_tokens":3384,"output_tokens":659,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113704':16A,19A '-2026':15A,18A '0.4.3':37B,89C '2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224':130C 'a2a':2A,20B,22B,33B,85C 'a2a-rs':1A,21B,32B,84C 'a2aproject':83C 'accept':38B 'advis':135C 'affect':91C 'appli':131C 'argument':41B,109C 'attack':48B,119C 'choos':60B 'compon':101C 'config':6A 'crates/server/src/push_notification_sender.rs':98C 'cve':14A,17A 'destin':57B 'enabl':7A 'file':97C 'forgeri':12A,67B,117C 'found':81C 'function':93C 'handler':104C 'host':28B 'http':54B 'httppushsend':30B,94C 'intern':71B 'issu':139C 'launch':122C 'lead':111C 'make':50B 'manipul':106C 'may':120C 'name':125C 'notif':5A,103C 'packag':24B 'patch':128C,133C 'push':4A,102C 'reach':70B 'remot':13A,123C 'request':11A,55B,66B,116C 'resolv':137C 'rs':3A,23B,34B,86C 'rust':25B 'see':76B 'self':27B 'self-host':26B 'send':53B 'server':9A,52B,64B,74B,114C 'server-sid':8A,63B,113C 'servic':72B 'side':10A,65B,115C 'taskpushnotificationconfig':40B,110C 'valid':45B 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Teams running an A2A server built on a2a-rs up to 0.4.3 that accepts push notification configuration from remote clients are exposed, because the server will fetch the URL they supply. Deployments that do not expose push notification features to untrusted callers, or that run no a2a-rs server, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113704","severity":null,"published_at":"2026-10-20T22:19:29+00:00","modified_at":"2026-10-21T16:17:24+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}