a2a-go CVE-2026-116478

Exploitation requires reaching the Push Notification Handler path that runs factory.CreateExecutor and causing the push-config save to return an error - only on that save failure does the pre-patch code surface the sensitive data, because the error string interpolated the entire params.Config.PushConfig structure. The disclosed information is limited to that push notification configuration (e.g., callback/webhook details), with no integrity or availability impact. Limiting factors: the leak only manifests when the underlying save operation actually fails, and the value of what is exposed depends on what the deployment stores in PushConfig; per the supplied CVSS vector no authentication (PR:N) or user interaction (UI:N) is required. The complete fix is upgrading to a2a-go v2.5.0 as stated by the vendor.

The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.9, Medium) describes a remotely reachable, low-complexity, unauthenticated issue (PR:N) whose only consequence is a low confidentiality impact (VC:L) with no integrity or availability effect - consistent with CWE-209 information exposure through an error message. The exploitation maturity is explicitly undefined in the vector (E:X), and no EPSS score, no CISA KEV listing, and no public exploit reference are present in the input, so there is no signal of active or probable exploitation. The vuln.today Decision label is 'this_month' (a moderate, scheduled-remediation priority - not act_now or emergency), which aligns with the limited, confidentiality-only impact. Net assessment: this is a legitimate but low-impact information-disclosure bug rather than a high-urgency issue; the main caveat is that the sensitivity of what leaks (push notification configuration, which can carry callback URLs or credentials) depends on deployment, and no exploitation-probability data (EPSS) was provided to refine likelihood.

A remote attacker interacts with the A2A server's Push Notification Handler and causes the push-configuration save in CreateExecutor to fail; the pre-patch code returned the full params.Config.PushConfig value inside the error string, so the attacker receives push notification configuration details (potentially callback endpoints or associated secrets) back in the error response. No public proof-of-concept or exploit code is referenced in the input. The attack vector is network with low complexity and no required privileges per the supplied CVSS vector.