Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116478a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure

Medium 5.3

In plain English

A medium-severity information exposure in a2a-go from a2aproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 62.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
a2aproject	a2a-go	2.02.12.22.32.4.0

Weakness: CWE-209, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

References

VDB-426391 | a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure vdb-entry, technical-description
VDB-426391 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-116478 | CVE Analysis and Report third-party-advisory
Submit #1014887 | a2aproject a2a-go ≤ v2.4.0 CWE-209 third-party-advisory
https://github.com/a2aproject/a2a-go/pull/393 issue-tracking, patch
https://github.com/a2aproject/a2a-go/commit/f4d588216b0c9520e94d571bab725c38ce23064c patch
https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0 patch
https://github.com/a2aproject/a2a-go/ product