a2a-js CVE-2026-118128

Requires issuing a cancelTask request through the no-event-bus path of DefaultRequestHandler concurrently with the executor's task-status write, exploiting the window where cancel performs load→check→mutate→save without acquiring the per-(tenant, owner, taskId) write lock or checking terminal state. Limiting factors: exploitation is non-deterministic and depends on winning a narrow timing race against the executor's completion; it affects a2a-js versions up to and including 1.1.0 and is fixed in 1.2.0; the input does not confirm whether sending cancel requests to the A2A server requires authentication, so the practical attacker population is unverified. The only complete fix stated by the vendor is upgrading to 1.2.0.

This is a medium-severity integrity/availability issue, not an emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 and implies trivial remote exploitation, but that under-represents the trigger: the PR diff shows the flaw is a classic check-then-act race in the no-event-bus cancelTask path (load → check → mutate → save with no per-task write lock), so reliable exploitation requires hitting a narrow timing window between an executor's completion write and the cancel's save - closer to AC:H / AT:P than AC:L/AT:N. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit was identified; the only exploitation signal is VulDB's 'this_month' priority label. The impact is limited to task-state corruption (VC:N, VI:L, VA:L) - a COMPLETED status being clobbered by CANCELED or vice versa - not code execution or data disclosure. Note the conflict: the input Tags include 'Information Disclosure', but the CVSS vector sets VC:N (no confidentiality impact) and the source evidence describes state corruption, not disclosure - the tag appears inaccurate. Authentication requirements are not confirmed: the vector states PR:N but the input does not establish whether issuing cancel requests to the A2A server requires authentication. Overall: a real but bounded correctness/robustness defect worth patching on a normal monthly cadence, not a drop-everything priority.

A client able to submit requests to the A2A server issues a cancelTask for an in-progress task at the precise moment the executor publishes its final status; because the no-bus cancel path reads, checks, then saves without a write lock, the CANCELED write overwrites the just-written COMPLETED status (or the cancel is silently lost), leaving the task in a corrupted/inconsistent state. Success depends on winning the race window, so it is not deterministic. No public exploit code was identified at time of analysis.