{"id":"CVE-2026-116478","kind":"vulnerability","aliases":["CVE-2026-116478"],"related":[],"title":"a2a-go: push notification handler leaks information through error messages","description":"A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.","summary":"The a2a-go Go library's push notification handler, in the CreateExecutor function of a2asrv/agentexec.go, returns error messages that expose internal information. A remote attacker can trigger these responses to learn details about the server.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a2a","agent-to-agent","go","package","self-hosted"],"not_affected_if":["no-a2a-server","no-push-notifications"],"how_to_check":"- Check the a2a-go version in go.mod: `go list -m github.com/a2aproject/a2a-go` (affected: up to `2.4.0`)\n- Confirm whether the service exposes push notification endpoints built on a2asrv.","fix":"- Upgrade a2a-go to `2.5.0` or later (patch commit f4d588216b0c9520e94d571bab725c38ce23064c)","status":"open","published_at":"2026-10-26T20:17:55+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:51:45+00:00","updated_at":"2026-10-26T20:51:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T20:51:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade a2a-go to `2.5.0` or later (patch commit f4d588216b0c9520e94d571bab725c38ce23064c)","reach":"internet","title":"a2a-go: push notification handler leaks information through error messages","impact":"low","summary":"The a2a-go Go library's push notification handler, in the CreateExecutor function of a2asrv/agentexec.go, returns error messages that expose internal information. A remote attacker can trigger these responses to learn details about the server.","category":"package","nicknames":[],"who_cares":["go","a2a","agent-to-agent","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Internal error details are disclosed to remote callers","analyst_note":"","how_to_check":"- Check the a2a-go version in go.mod: `go list -m github.com/a2aproject/a2a-go` (affected: up to `2.4.0`)\n- Confirm whether the service exposes push notification endpoints built on a2asrv.","needs_analyst":false,"not_affected_if":["no-push-notifications","no-a2a-server"],"who_is_affected":"Services that embed the a2a-go library and expose its push notification handler to remote clients are exposed. Applications that do not use the push notification handler, or that do not serve A2A endpoints, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000585,"input_tokens":3374,"output_tokens":496,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116478':14A,17A '-2026':13A,16A '2.4.0':75C '2.5.0':111C 'a2a':2A,18B,30B,71C 'a2a-go':1A,29B,70C 'a2aproject':69C 'a2asrv/agentexec.go':43B,84C 'affect':77C,127C 'agent':20B,22B 'agent-to-ag':19B 'attack':53B,106C 'compon':87C,128C 'createexecutor':40B,80C 'cve':12A,15A 'detail':60B 'detect':67C 'error':10A,45B,98C 'expos':48B 'exposur':96C 'f4d588216b0c9520e94d571bab725c38ce23064c':120C 'file':83C 'function':41B,79C 'go':3A,23B,31B,32B,72C 'handler':6A,37B,90C 'host':27B 'identifi':118C 'inform':8A,50B,95C 'intern':49B 'issu':114C 'launch':104C 'leak':7A 'learn':59B 'librari':33B 'manipul':92C 'messag':11A,46B,99C 'mitig':112C 'notif':5A,36B,89C 'packag':24B 'patch':116C 'possibl':102C 'push':4A,35B,88C 'recommend':123C 'remot':52B,107C 'respons':57B 'result':93C 'return':44B 'self':26B 'self-host':25B 'server':63B 'trigger':55B 'upgrad':108C,125C 'version':110C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Services that embed the a2a-go library and expose its push notification handler to remote clients are exposed. Applications that do not use the push notification handler, or that do not serve A2A endpoints, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116478","severity":null,"published_at":"2026-10-26T20:17:55+00:00","modified_at":"2026-10-26T20:17:55+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}