Description

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push Notification Sender. The manipulation of the argument push_info.url leads to server-side request forgery. Remote exploitation of the attack is possible. Upgrading to version 1.1.4 is able to mitigate this issue. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-14T15:17:13.200Z",
  "pubdate": "2026-09-14T15:17:13.200Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the a2aproject a2a-python library, specifically within the Push Notification Sender component.\nThe vulnerability is triggered by improper sanitization of the push_info.url argument processed by the _dispatch_notification function.\nBy manipulating this argument, a remote attacker can force the server to initiate unauthorized HTTP requests to arbitrary internal or external destinations.\nThis flaw allows attackers to bypass network perimeter security, potentially interacting with internal services, metadata APIs, or sensitive internal resources that are not directly exposed to the internet.\nThe impact includes unauthorized information disclosure and potential lateral movement within the network infrastructure.\nThe vulnerability affects all versions of a2a-python up to and including 1.1.3.\nExploitation is possible remotely without requiring prior authentication, necessitating an immediate upgrade to version 1.1.4 to mitigate the identified risk.",
  "technicalDetails": "The vulnerability is located in the src/a2a/server/tasks/base_push_notification_sender.py file within the _dispatch_notification function of the a2aproject a2a-python library.\nThe root cause of this SSRF vulnerability is the lack of robust input validation and URI scheme restriction on the push_info.url object when it is passed to the underlying request dispatch mechanism.\nWhen _dispatch_notification is invoked, the application consumes the push_info.url parameter to perform an outbound network request as part of the notification workflow.\nBecause the function fails to validate or whitelist the target host and protocol, an attacker can supply a crafted URL pointing to unauthorized endpoints.\nAttack flow: 1. An attacker identifies an entry point where push_info objects are accepted as input. 2. The attacker crafts a malicious push_info object containing a target URL that points to internal infrastructure, such as localhost, private IP addresses (e.g., 169.254.169.254 for cloud metadata), or other protected internal services. 3. The server-side code, acting as a proxy, executes an HTTP request to the attacker-supplied URL using its own internal network context. 4. The server inadvertently returns the response or side-effect of the internal request, confirming the vulnerability. 5. If the target internal service does not require secondary authentication, the attacker can extract sensitive information or interact with internal APIs.\nThe vulnerability is critical as it allows for the manipulation of the application's outbound traffic. Given that this function acts as a task-based sender, it may be reachable through various interfaces that facilitate push notifications. The lack of input sanitization means the library trusts the provided URL implicitly.\nSuccessful exploitation permits the attacker to bypass firewall restrictions and gain unauthorized access to internal resources accessible from the host server. The post-exploitation impact may range from simple port scanning of internal infrastructure to the extraction of sensitive cloud instance metadata or the abuse of internal administrative interfaces that assume implicit trust from internal traffic.\nThis vulnerability is present in versions up to 1.1.3, and the remediation path requires updating the library to 1.1.4, which presumably introduces stricter URL parsing and validation logic to prevent unauthorized request targets."
}