CVE-2026-113704

Deferred Deferred - Pending Action

Server-Side Request Forgery in a2a-rs Push Notification Handler

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: VulDB

Description

A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113704

EUVD

EUVD-2026-106865

Affected Vendors & Products

Vendor	Product	Version / Range
a2aproject	a2a-rs	0.4.0
a2aproject	a2a-rs	0.4.1
a2aproject	a2a-rs	0.4.2
a2aproject	a2a-rs	0.4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in the a2a-rs project up to version 0.4.3. It occurs in the HttpPushSender function of the push_notification_sender.rs file, where manipulation of the TaskPushNotificationConfig argument allows an attacker to forge requests to internal or external servers. The issue has been patched in commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224.

Detection Guidance

This vulnerability involves server-side request forgery in the a2a-rs component. To detect it, inspect network traffic for unusual outbound requests originating from the a2a-rs service, particularly those involving the HttpPushSender function. Check logs for anomalies in TaskPushNotificationConfig handling. Ensure the a2a-rs version is below 0.4.3, as the patch is applied in 0.4.3 and later.

Impact Analysis

An attacker could exploit this to send crafted requests from your server to other systems, potentially accessing internal resources, exfiltrating data, or interacting with services you don't intend. This could lead to unauthorized actions, data breaches, or service disruption if the forged requests trigger unintended behavior.

Compliance Impact

This vulnerability enables server-side request forgery (SSRF) via manipulation of TaskPushNotificationConfig in the HttpPushSender function. SSRF can expose internal systems to unauthorized access, potentially leading to data breaches or unauthorized data exfiltration. For GDPR, this could result in unauthorized processing or disclosure of personal data, violating principles of data protection and user consent. For HIPAA, it may compromise protected health information by allowing unauthorized access to internal systems handling sensitive data.

Mitigation Strategies

Update the a2a-rs component to the patched version (commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224) to resolve the server-side request forgery vulnerability in the HttpPushSender function.

Hi! I’m here to help you understand CVE-2026-113704. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...