What’s Vulnerable › Vulnerabilities

CVE-2026-90790: a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-15
• Weakness: CWE-918

Description

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push Notification Sender. The manipulation of the argument push_info.url leads to server-side request forgery. Remote exploitation of the attack is possible. Upgrading to version 1.1.4 is able to mitigate this issue. It is suggested to upgrade the affected component.

Affected products

• a2aproject a2a-python: 1.1.0, 1.1.1, 1.1.2, 1.1.3

References

• https://github.com/a2aproject/a2a-python/
• https://github.com/a2aproject/a2a-python/pull/1164
• https://github.com/a2aproject/a2a-python/pull/1169
• https://github.com/a2aproject/a2a-python/releases/tag/v1.1.4
• https://vuldb.com/cve/CVE-2026-90790
• https://vuldb.com/submit/919747
• https://vuldb.com/vuln/403296
• https://vuldb.com/vuln/403296/cti

Get alerted when CVE-2026-90790 or the next vulnerability affects your stack