CVE-2026-116478 a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure

Medium 6.9 Published 26 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116478?

CVE-2026-116478 is a medium-severity vulnerability in a2aproject a2a-go, published on 26 Oct 2026.

Official description

A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.

Weakness: CWE-209, CWE-200

Which versions are affected by CVE-2026-116478?

How do I fix CVE-2026-116478?

No fix has been published for CVE-2026-116478 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116478 being exploited?

There is no known exploitation of CVE-2026-116478 in the wild and no public exploit code.

Sources

Also known as GHSA-6j8p-4q4m-9rmr.