Live › vulnerability › CVE-2026-116478
Go to dashboardThe a2a-go Go library's push notification handler, in the CreateExecutor function of a2asrv/agentexec.go, returns error messages that expose internal information. A remote attacker can trigger these responses to learn details about the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Services that embed the a2a-go library and expose its push notification handler to remote clients are exposed. Applications that do not use the push notification handler, or that do not serve A2A endpoints, can skip it.
No product ranges from the sources yet.
go list -m github.com/a2aproject/a2a-go (affected: up to 2.4.0)2.5.0 or later (patch commit f4d588216b0c9520e94d571bab725c38ce23064c)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-116478")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.