a2a-python · Vulnerability
cve-program · CVE-2026-90790
PublishedA security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push Notification Sender. The manipulation of the argument push_info.url leads to server-side request forgery. Remote exploitation of the attack is possible. Upgrading to version 1.1.4 is able to mitigate this issue. It is suggested to upgrade the affected component.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-90790 · CVE overview and exploitation status
cve-program · CVE-2026-90790
- https://vuldb.com/vuln/403296
- https://vuldb.com/vuln/403296/cti
- https://vuldb.com/cve/CVE-2026-90790
- https://vuldb.com/submit/919747
- https://github.com/a2aproject/a2a-python/pull/1164
- https://github.com/a2aproject/a2a-python/pull/1169
- https://github.com/a2aproject/a2a-python/releases/tag/v1.1.4
- https://github.com/a2aproject/a2a-python/
Related changes
Linked by CVE identifierNo related changes are available here.