CVE-2026-90790

5.3 mediumEPSS 0.4%

Medium (5.3). EPSS 0.4% chance of exploitation in the next 30 days.

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push Notification Sender. The manipulation of the argument push_info.url leads to server-side request forgery. Remote exploitation of the attack is possible. Upgrading to version 1.1.4 is able to mitigate this issue. It is suggested to upgrade the affected component.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-09-14
Modified: 2026-09-15
Record from: the NVD, synced 2026-10-19

References

https://github.com/a2aproject/a2a-python/
https://github.com/a2aproject/a2a-python/pull/1164
https://github.com/a2aproject/a2a-python/pull/1169
https://github.com/a2aproject/a2a-python/releases/tag/v1.1.4
https://vuldb.com/cve/CVE-2026-90790

Check your stack JSON