a2aproject a2a-java TaskManager.saveTaskEvent race condition
CVE-2026-117507

5.3MEDIUM

Key Information:

Vendor

A2aproject

Status
A2a-java
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117507?

A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded.

Affected Version(s)

a2a-java 1.2.0.Final

a2a-java 1.3.0.Final

References

https://vuldb.com/vuln/427074
vdb-entrytechnical-description
https://vuldb.com/vuln/427074/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-117507
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

colorfullbz (VulDB User)
.