a2a-rs CVE-2026-113704

Requires the server to have the push-notification feature enabled (an HttpPushSender configured via with_push_notifications); on affected versions ≤0.4.3 this sender performed NO URL validation, so any client able to submit a TaskPushNotificationConfig can set an arbitrary webhook URL. Concrete abuse targets confirmed by the patch: loopback (127.0.0.1/::1/localhost), RFC1918/ULA private ranges, link-local, multicast, unspecified addresses, cloud-metadata endpoints (169.254.169.254, metadata.google.internal, metadata.azure.com), and non-http/https schemes. Limiting factors for defenders: push notifications must be enabled (not required in every deployment), the SSRF is effectively blind (the push HTTP response is not reflected to the attacker, constraining data exfiltration to timing/behavioral inference), and the fix is already available so only unpatched ≤0.4.3 instances are exposed.

All signals point to a genuine but moderate-severity SSRF rather than a top-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation, but the impact metrics are uniformly Low (VC:L/VI:L/VA:L, SC:N) yielding a 6.9 Medium score, consistent with a largely blind SSRF where the server initiates outbound requests the attacker cannot fully read back. No EPSS probability, SSVC decision data, KEV entry, or public POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of active or automatable exploitation. The patch diff corroborates the real-world concern - it explicitly blocks loopback, RFC1918/ULA private, link-local, multicast, unspecified, and cloud-metadata hosts (169.254.169.254, metadata.google.internal, metadata.azure.com), confirming the primary abuse case is reaching internal/cloud-metadata endpoints. Net judgment: a legitimately exploitable unauthenticated flaw, but the limited (blind, Low-impact) consequence plus a niche Rust library footprint and absence of EPSS/KEV/POC signals place it below genuinely urgent issues. Missing data to flag: no EPSS score, no SSVC framework values, and no KEV/POC status were provided, so exploitation likelihood is inferred from the vector alone.

On an a2a-rs server (≤0.4.3) with push notifications enabled, a remote client submits a task whose TaskPushNotificationConfig specifies a webhook URL such as http://169.254.169.254/latest/meta-data/ or an internal service address. The unpatched HttpPushSender performs no URL validation and dispatches HTTP requests to that attacker-chosen target, letting the attacker coerce the server into probing internal networks or cloud-metadata endpoints. No public exploit code is identified; exploitation is low-complexity (AC:L) and requires no user interaction, but the SSRF is largely blind since the push response is not returned to the attacker.