Log in Start free

Vulnerability · Published Sep 14, 2026 · Assigned by VulDB

CVE-2026-90790a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery

Medium 6.3

In plain English

A medium-severity server-side request forgery in a2a-python from a2aproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.4%top 68.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push Notification Sender. The manipulation of the argument push_info.url leads to server-side request forgery. Remote exploitation of the attack is possible. Upgrading to version 1.1.4 is able to mitigate this issue. It is suggested to upgrade the affected component.

Affected products (as reported)

VendorProductVersions
a2aproject a2a-python 1.1.01.1.11.1.21.1.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References