CVE-2026-116476

MediumCVSS 5.4

Published: 26/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.

Risk Assessment

Unpredictable application behavior and business logic errors may occur due to the race condition, potentially affecting task processing integrity.

Recommendation

Track the fix pull request and apply it once accepted; until then, limit remote exposure of the service.

Other vulnerabilities in a2a-dotnet

CVE-2026-116477Medium
A security vulnerability was detected in a2a-dotnet up to 1.0.0-preview2 affecting the A2AJsonRpcProcessor.ProcessRequestAsync function in src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the Parser component. The manipulation leads to information exposure through error messages. The attack can be launched remotely, and upgrading to version 1.0.0-preview3 resolves the issue.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS