CVE-2026-116478
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability was detected in a2a-go up to 2.4.0 affecting the CreateExecutor function in a2asrv/agentexec.go of the Push Notification Handler component. The manipulation results in information exposure through error messages. The attack can be launched remotely, and upgrading to version 2.5.0 mitigates the issue.
Risk Assessment
A remote attacker may obtain sensitive data leaked in error messages, which can be used for further exploitation. The risk affects organizations using a2a-go up to 2.4.0 in network-accessible environments.
Recommendation
Upgrade a2a-go to version 2.5.0 containing patch f4d588216b0c9520e94d571bab725c38ce23064c. Verify that all deployments use the new version.
Other vulnerabilities in a2a-go
See all- CVE-2026-117504Medium
A vulnerability was identified in a2aproject a2a-go up to 2.4.0 in the Cancel function of internal/taskexec/distributed_manager.go of the Distributed Manager component. Manipulation leads to denial of service, and the attack can be launched remotely.
- CVE-2026-117503Medium
A vulnerability was determined in a2aproject a2a-go up to 2.4.0 in an unknown function of a2asrv/rest.go of the REST SSE handler component. Manipulation causes resource consumption, and the attack can be initiated remotely.
Original NVD description (English source)
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS