Description
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.
Published: 2026-10-20
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a server‑side request forgery in the HttpPushSender component of a2a-rs. Arbitrary manipulation of TaskPushNotificationConfig allows an attacker to cause the server to fetch any URL, potentially accessing internal services or leaking data. Failure to restrict these outgoing requests could expose sensitive information or enable further attacks against connected systems.

Affected Systems

Versions of a2a-rs up to 0.4.3 are affected. The vulnerability originates in the push_notification_sender.rs file within the Push Notification Handler, which is part of the a2aproject:a2a-rs product line. The change that fixes the issue is included in commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224, which should be applied to all affected deployments.

Risk and Exploitability

The CVSS score of 6.9 marks it as moderate severity, and the EPSS score of < 1% indicates a low probability of exploitation. The CVE is not listed in the CISA KEV catalog. The vulnerability can be leveraged remotely by submitting a crafted push notification configuration to the server, which is inferred from the description that the attack may be launched remotely. There are no publicly known exploits as of the data available.

Generated by OpenCVE AI on October 21, 2026 at 15:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224 to upgrade a2a-rs to a version that contains the fix.
  • If an upgrade cannot be performed immediately, restrict outbound URLs that the Push Notification handler may contact to prevent internal network exposure.
  • Enable logging and regularly monitor the Push Notification service for unexpected outbound HTTP or HTTPS traffic.
  • Validate or sanitize any URLs received through TaskPushNotificationConfig before sending them on behalf of the server.

Generated by OpenCVE AI on October 21, 2026 at 15:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.
Title a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
First Time appeared A2aproject
A2aproject a2a-rs
Weaknesses CWE-918
CPEs cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*
Vendors & Products A2aproject
A2aproject a2a-rs
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

A2aproject A2a-rs
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-21T15:51:31.062Z

Reserved: 2026-10-20T15:57:11.575Z

Link: CVE-2026-113704

cve-icon Vulnrichment

Updated: 2026-10-21T14:40:31.617Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T22:19:29.230

Modified: 2026-10-21T16:17:24.723

Link: CVE-2026-113704

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T20:15:05Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)