a2aproject has 22 CVEs on record. Disclosure cadence is accelerating: 22 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 19. The median CVSS is 5.4 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-200 (5) and CWE-209 (4). Most affected products: a2a-java (9), a2a-rs (4), a2a-go (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 22 prev 0
Products
- a2a-java 9
- a2a-rs 4
- a2a-go 3
- a2a-dotnet 2
- a2a-js 1
- a2a-python 1
Worst active — by depth score
CVE-2026-111765High· 7.5A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix53CVE-2026-111764High· 7.5A2A Java SDK has a fail-open default task authorization53CVE-2026-111761Medium· 5.8A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery44CVE-2026-113704High· 7.3a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery40CVE-2026-90819High· 7.3A weakness has been identified in a2aproject a2a-java 1.2.040
a2aproject vulnerabilities
CVEs affecting a2aproject, newest first. Open any entry for full detail, references, and exploit status.
22 CVEsRSS
CVE-2026-118128Medium· 6.5a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition
A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to ra…
CVE-2026-117507Medium· 5.4a2aproject a2a-java TaskManager.saveTaskEvent race condition
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to versio…
CVE-2026-117506Medium· 4.3a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sd…
CVE-2026-117505Medium· 4.3a2aproject a2a-java ChildQueue queue.offer resource consumption
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. The attack can be init…
CVE-2026-117504Medium· 5.3a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of …
CVE-2026-117503Medium· 5.3a2aproject a2a-go REST SSE handler rest.go resource consumption
A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the …
CVE-2026-116478Medium· 5.3a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through …
CVE-2026-116479Medium· 4.3a2aproject a2a-java JSON-RPC Error getMessage information exposure
A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiate…
CVE-2026-116476Medium· 5.4a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition
A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attac…
CVE-2026-116477Medium· 4.3a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component…
CVE-2026-113707Medium· 5.4a2aproject a2a-rs inmemory.rs update race condition
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attac…
CVE-2026-113705Medium· 5.3a2aproject a2a-rs error.rs information exposure
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack …
CVE-2026-113706Low· 3.5a2aproject a2a-rs inmemory.rs information disclosure
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attac…
CVE-2026-113704High· 7.3a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argu…
CVE-2026-111763Medium· 5.7A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When …
CVE-2026-111764High· 7.5PoCA2A Java SDK has a fail-open default task authorization
A2A Java SDK has a fail-open default task authorization
CVE-2026-111765High· 7.5PoCA2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in Android…
CVE-2026-111762Medium· 5.7A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure
A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure
CVE-2026-111761Medium· 5.8PoCA2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme r…
CVE-2026-90819High· 7.3A weakness has been identified in a2aproject a2a-java 1.2.0
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificatio…
CVE-2026-90820Medium· 4.3A security vulnerability has been detected in a2aproject a2a-java 1.2.0
A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandl…
CVE-2026-90790Medium· 6.3A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3
A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push Notification Sender…