CVE-2026-90790: a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery
A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to server-side request forgery. Remote exploitation of the attack is possible. Upgrading to version 1.1.4 is able to mitigate this issue. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2aproject a2a-python Push Notification Senderto a version that resolves this vulnerability.Fixed in 1.1.4
Event History
Frequently Asked Questions
Which deployments are affected?
a2aproject a2a-python versions up to and including 1.1.3 are affected in the Push Notification Sender component, specifically its notification dispatch handling.
What does an attacker need to exploit this issue?
Remote exploitation is possible, and the vulnerable behavior is triggered by manipulating the push_info.url argument. The supplied data does not specify what application role or interface allows an attacker to control that value.
What should be done to remediate the vulnerability?
Upgrade a2a-python to version 1.1.4, which mitigates the issue.