CVE-2026-116478
a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.
| CWE | CWE-209 CWE-200 |
| Vendor | a2aproject |
| Product | a2a-go |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for a2aproject a2a-go
Be the first to know when new medium vulnerabilities affecting a2aproject a2a-go are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
a2aproject / a2a-go
2.0 2.1 2.2 2.3 2.4.0
References
vuldb.com: https://vuldb.com/vuln/426391 vuldb.com: https://vuldb.com/vuln/426391/cti vuldb.com: https://vuldb.com/cve/CVE-2026-116478 vuldb.com: https://vuldb.com/submit/1014887 github.com: https://github.com/a2aproject/a2a-go/pull/393 github.com: https://github.com/a2aproject/a2a-go/commit/f4d588216b0c9520e94d571bab725c38ce23064c github.com: https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0 github.com: https://github.com/a2aproject/a2a-go/
Credits
🔍 colorfullbz (VulDB User)