A2a-go includes a Cancel function in its Distributed Manager that permits remote execution of a cancellation operation. Exploiting a flaw in this function allows an attacker to craft requests that trigger the Cancel action to terminate or disrupt ongoing tasks, resulting in a denial of service. The weakness corresponds to CWE-404, an improper limitation of permissions that can allow unauthorized cancellation.

All installations of the a2aproject a2a-go component up to and including version 2.4.0 are vulnerable. The fix is provided in release 2.5.0, which incorporates patch commit 14e41a978b31e134ffa1170d8657f9dd98529aa3. Vendors should update to 2.5.0 or later to remediate the issue.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not available, so the exact likelihood of exploitation is unknown. The vulnerability can be triggered remotely, but no specific authentication or privilege prerequisites are detailed; thus, any remote party with network access to the Distributed Manager API could potentially abuse the function. The system is not listed in the CISA KEV catalog, implying no known widespread exploitation, but the lack of evidence does not mitigate the risk.