Executive brief
a2a-python is the official Python SDK for the Agent2Agent (A2A) Protocol, used for inter-agent communication. A server-side request forgery (SSRF) vulnerability in the push notification sender allows clients to make the agent server send HTTP requests to arbitrary internal network addresses—including cloud metadata endpoints, localhost admin panels, or internal services—by supplying a malicious webhook URL, potentially exposing sensitive configuration or enabling lateral movement attacks.
Technical details
The vulnerability exists in BasePushNotificationSender._dispatch_notification in src/a2a/server/tasks/base_push_notification_sender.py. When dispatching push notifications, the function uses the push_info.url parameter directly without validating the destination address. An attacker can register a webhook callback pointing to internal resources (RFC1918 ranges, loopback, link-local, metadata endpoints like 169.254.169.254) and trigger task events to force the agent server to make requests to those targets. The vulnerability is reachable through multiple configuration paths (tasks/pushNotificationConfig/create and inline on message/send). Version 1.1.4 adds URL validation at dispatch time, restricting schemes to http/https, blocking loopback/private/reserved addresses, and allowing an opt-in flag to permit private network targets. DNS rebinding attacks remain theoretically possible but static internal targets are fully blocked.
Affected products
- a2aproject a2a-python up to 1.1.3
Timeline
- 2026-09-14: disclosed: Published in NVD
- 2026-09-03: patched: Fixed in version 1.1.4 via PR #1164