Medium severity · published Oct 26, 2026
CVE-2026-116478
a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
New
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A2
a2a-go · a2aproject
2.0; 2.1; 2.2; 2.3; 2.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116478
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116478
github.com
https://github.com/a2aproject/a2a-go/
github.com
https://github.com/a2aproject/a2a-go/commit/f4d588216b0c9520e94d571bab725c38ce23064c
github.com
https://github.com/a2aproject/a2a-go/pull/393
github.com
https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0
vuldb.com
https://vuldb.com/cve/CVE-2026-116478
vuldb.com
https://vuldb.com/submit/1014887
More from a2a-go
5.3
CVE-2026-117504
a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service
5.3
CVE-2026-117503
a2aproject a2a-go REST SSE handler rest.go resource consumption