Server-Side Request Forgery in a2aproject Push Notification Handler
CVE-2026-113704

6.9MEDIUM

Key Information:

Vendor

A2aproject

Status
A2a-rs
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113704?

A server-side request forgery vulnerability has been identified in the a2aproject a2a-rs product, specifically within the Push Notification Handler's HttpPushSender function. This vulnerability arises due to improper handling of the TaskPushNotificationConfig argument, allowing remote attackers to manipulate server responses. To mitigate this risk, users are advised to apply the provided patch, which addresses the issue effectively.

Affected Version(s)

a2a-rs 0.4.0

a2a-rs 0.4.1

a2a-rs 0.4.2

References

https://vuldb.com/vuln/422865
vdb-entrytechnical-description
https://vuldb.com/vuln/422865/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-113704
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

colorfullbz (VulDB User)
.