CVE-2026-113704: Server-Side Request Forgery in a2aproject a2a-rs
Description
CVE-2026-113704 is a server-side request forgery (SSRF) vulnerability in a2aproject a2a-rs versions 0.4.0 through 0.4.3. It affects the HttpPushSender function in the Push Notification Handler component. The vulnerability allows remote attackers to manipulate the TaskPushNotificationConfig argument, potentially causing the server to make unauthorized requests. A patch identified by commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224 is available to fix this issue.
CVSS v4.0
Score 6.9medium
Affected software
a2aproject
a2a-rs
pkg:cargo/github/a2aproject/a2a-rscpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the a2aproject a2a-rs software up to version 0.4.3, specifically in the HttpPushSender function within crates/server/src/push_notification_sender.rs. Manipulating the TaskPushNotificationConfig argument can lead to server-side request forgery, enabling an attacker to make the server perform unintended HTTP requests. The vulnerability is remotely exploitable without authentication. A patch has been created (commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224) to address the issue.
Potential Impact
Successful exploitation of this SSRF vulnerability could allow an attacker to cause the vulnerable server to send arbitrary HTTP requests to internal or external systems. This may lead to information disclosure or interaction with internal services not otherwise accessible. The CVSS 4.0 base score is 6.9 (medium severity), indicating a moderate impact with network attack vector, no privileges required, and low to limited confidentiality, integrity, and availability impacts.
Mitigation Recommendations
A patch is available for this vulnerability, identified by commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. It is advised to apply this patch to versions 0.4.0 through 0.4.3 of a2a-rs to remediate the issue. No vendor advisory content contradicts this recommendation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-20T15:57:11.575Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad7e8e52cdf04f656695f79
Added to database: 10/20/2026, 22:19:17 UTC
Last enriched: 10/20/2026, 22:48:44 UTC
Last updated: 10/20/2026, 22:48:44 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.