Information Exposure Vulnerability in a2aproject a2a-dotnet by A2A
CVE-2026-116477

5.3MEDIUM

Key Information:

Vendor

A2aproject

Status
A2a-dotnet
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116477?

A security vulnerability exists in the a2aproject's a2a-dotnet library, particularly within the A2AJsonRpcProcessor.ProcessRequestAsync function. This vulnerability can lead to sensitive information exposure through error messages and can be exploited remotely. Users are advised to upgrade to version 1.0.0-preview3 to resolve this issue. The patch identifier for the fix is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. It is crucial for developers utilizing this library to implement the recommended updates to ensure application security.

Affected Version(s)

a2a-dotnet 1.0.0-preview2

a2a-dotnet 1.0.0-preview3

References

https://vuldb.com/vuln/426390
vdb-entrytechnical-description
https://vuldb.com/vuln/426390/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116477
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

colorfullbz (VulDB User)
.