---
id: "CVE-2026-116478"
kind: "vulnerability"
aliases: ["CVE-2026-116478"]
title: "a2a-go: push notification handler leaks information through error messages"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["a2a", "agent-to-agent", "go", "package", "self-hosted"]
not_affected_if: ["no-a2a-server", "no-push-notifications"]
published_at: "2026-10-26T20:17:55+00:00"
first_seen_at: "2026-10-26T20:50:17+00:00"
updated_at: "2026-10-26T20:51:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116478", "first_seen_at": "2026-10-26T20:50:17+00:00"}]
---

# a2a-go: push notification handler leaks information through error messages

The a2a-go Go library's push notification handler, in the CreateExecutor function of a2asrv/agentexec.go, returns error messages that expose internal information. A remote attacker can trigger these responses to learn details about the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the a2a-go version in go.mod: `go list -m github.com/a2aproject/a2a-go` (affected: up to `2.4.0`)
- Confirm whether the service exposes push notification endpoints built on a2asrv.

## Fix

- Upgrade a2a-go to `2.5.0` or later (patch commit f4d588216b0c9520e94d571bab725c38ce23064c)

## Timeline

- 2026-10-26T20:50:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116478

## From the sources

A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_