CVE-2026-116478
Received Received - Intake

Information Exposure via Error Message in a2a-go

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116478
EUVD
EUVD-2026-110075

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
a2aproject a2a-go 2.0
a2aproject a2a-go 2.1
a2aproject a2a-go 2.2
a2aproject a2a-go 2.3
a2aproject a2a-go 2.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information exposure issue in the a2a-go library up to version 2.4.0. It occurs in the CreateExecutor function of the Push Notification Handler component. The flaw allows sensitive data, specifically PushConfig details like tokens, to be leaked through error messages when operations fail. Attackers can remotely trigger this by manipulating inputs, leading to unauthorized access to confidential information.

Detection Guidance

To detect this vulnerability, check if your a2a-go version is below 2.5.0. Use commands like 'a2a-go version' or inspect package dependencies in your project files. Review error logs for exposed sensitive information in push notification handler errors.

Impact Analysis

If you use a vulnerable version of a2a-go, attackers could exploit this to expose sensitive credentials or tokens through error messages. This may lead to unauthorized access to systems, data breaches, or further attacks on your infrastructure. Upgrading to version 2.5.0 or later mitigates this risk.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by exposing personal or health-related data through error messages. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. The information leak may result in non-compliance, legal penalties, or reputational damage.

Mitigation Strategies

Upgrade a2a-go to version 2.5.0 or later immediately. This version includes patches that remove sensitive data from error messages and fix related issues. Verify the upgrade by checking the version and testing functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart