CVE-2026-116478: a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2aproject a2a-goto a version that resolves this vulnerability.Fixed in 2.5.0Patch f4d588216b0c9520e94d571bab725c38ce23064c
Event History
Frequently Asked Questions
Which deployments are affected?
a2aproject a2a-go versions up to and including 2.4.0 are affected, specifically in the Push Notification Handler's CreateExecutor function in a2asrv/agentexec.go.
Can this be exploited remotely without authentication?
Yes. The supplied severity vector indicates network access, low attack complexity, no required privileges, and no user interaction.
What is the impact of successful exploitation?
The issue exposes information through error messages. The supplied vector indicates low confidentiality impact and no integrity or availability impact.
What should be done to remediate the issue?
Upgrade a2aproject a2a-go to version 2.5.0. The identified fix is commit f4d588216b0c9520e94d571bab725c38ce23064c.