MEDIUM

CVE-2026-90790

2026-09-14 CVSS v3.1

CVSS

6.3

Description

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push Notification Sender. The manipulation of the argument push_info.url leads to server-side request forgery. Remote exploitation of the attack is possible. Upgrading to version 1.1.4 is able to mitigate this issue. It is suggested to upgrade the affected component.

Weakness (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

EPSS Score

0.21%

Probability of exploitation in next 30 days

12.1th percentile

References

https://github.com/a2aproject/a2a-python/ https://github.com/a2aproject/a2a-python/pull/1164 https://github.com/a2aproject/a2a-python/pull/1169 https://github.com/a2aproject/a2a-python/releases/tag/v1.1.4 https://vuldb.com/cve/CVE-2026-90790 https://vuldb.com/submit/919747 https://vuldb.com/vuln/403296 https://vuldb.com/vuln/403296/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE