# CVE-2026-116478: a2a-go information exposure through error message in CreateExecutor

Source: https://junglewise.ai/threats/cve-2026-116478-a-vulnerability-was-detected-in-a2aproject-a2a-go-up-to-2-4-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116478 · Severity: medium · CVSS 5.3 · Published 2026-10-26

a2a-go is a Golang SDK for the A2A Protocol, used for agent-to-agent communication and task execution. A vulnerability in the Push Notification Handler's CreateExecutor function leaks sensitive credentials (tokens and authentication data) in error messages returned to callers. An attacker can trigger error conditions to extract these secrets remotely without authentication.

Technologies: [A2aproject A2a-Go](https://junglewise.ai/threats/technologies/a2a-go). Vendors: [A2aproject](https://junglewise.ai/threats/vendors/a2aproject).

## Quick answers

**Is CVE-2026-116478 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116478 being exploited in the wild.

**How severe is CVE-2026-116478?** Medium severity, with a CVSS score of 5.3, published 26 October 2026.

**Which products and versions are affected?** A2aproject A2a-Go up to 2.4.0.

**Is there a fix for CVE-2026-116478?** Yes: fixed in 2.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116478 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116478?** Check whether you run A2aproject A2a-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.5.0

## Technical details

The CreateExecutor function in a2asrv/agentexec.go improperly serializes the full PushConfig structure (including token and authentication.credentials fields) into error messages using %v formatting. The vulnerability affects versions up to 2.4.0 and is remotely exploitable. The fix restricts error output to the task ID only, omitting sensitive configuration data.

## Affected products

- a2aproject a2a-go up to 2.4.0

## Timeline

- 2026-10-26: disclosed

## References

- [https://github.com/a2aproject/a2a-go/](https://github.com/a2aproject/a2a-go/)
- [https://github.com/a2aproject/a2a-go/commit/f4d588216b0c9520e94d571bab725c38ce23064c](https://github.com/a2aproject/a2a-go/commit/f4d588216b0c9520e94d571bab725c38ce23064c)

## Related threats

- [a2aproject a2a-go denial of service in Distributed Manager Cancel](https://junglewise.ai/threats/cve-2026-117504-a-vulnerability-was-identified-in-a2aproject-a2a-go-up-to-2-4-0)
- [a2aproject a2a-go resource exhaustion in REST SSE handler](https://junglewise.ai/threats/cve-2026-117503-a-vulnerability-was-determined-in-a2aproject-a2a-go-up-to-2-4-0)