Is CVE-2026-90790 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90790 being exploited in the wild.

How severe is CVE-2026-90790?

Medium severity, with a CVSS score of 6.3, published 14 September 2026.

Which products and versions are affected?

A2aproject A2a-Python up to 1.1.3.

Is there a fix for CVE-2026-90790?

A patch was published on 2026-09-03: Fixed in version 1.1.4 via PR #1164 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-90790 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-90790?

Check whether you run A2aproject A2a-Python at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90790: a2aproject a2a-python server-side request forgery in push notification sender

CVE-2026-90790 · Severity: medium · CVSS 6.3 · Published 2026-09-14

a2a-python is the official Python SDK for the Agent2Agent (A2A) Protocol, used for inter-agent communication. A server-side request forgery (SSRF) vulnerability in the push notification sender allows clients to make the agent server send HTTP requests to arbitrary internal network addresses—including cloud metadata endpoints, localhost admin panels, or internal services—by supplying a malicious webhook URL, potentially exposing sensitive configuration or enabling lateral movement attacks.

Vendors: A2aproject.

Quick answers

Is CVE-2026-90790 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90790 being exploited in the wild.
How severe is CVE-2026-90790?: Medium severity, with a CVSS score of 6.3, published 14 September 2026.
Which products and versions are affected?: A2aproject A2a-Python up to 1.1.3.
Is there a fix for CVE-2026-90790?: A patch was published on 2026-09-03: Fixed in version 1.1.4 via PR #1164 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90790 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-90790?: Check whether you run A2aproject A2a-Python at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in BasePushNotificationSender._dispatch_notification in src/a2a/server/tasks/base_push_notification_sender.py. When dispatching push notifications, the function uses the push_info.url parameter directly without validating the destination address. An attacker can register a webhook callback pointing to internal resources (RFC1918 ranges, loopback, link-local, metadata endpoints like 169.254.169.254) and trigger task events to force the agent server to make requests to those targets. The vulnerability is reachable through multiple configuration paths (tasks/pushNotificationConfig/create and inline on message/send). Version 1.1.4 adds URL validation at dispatch time, restricting schemes to http/https, blocking loopback/private/reserved addresses, and allowing an opt-in flag to permit private network targets. DNS rebinding attacks remain theoretically possible but static internal targets are fully blocked.

Affected products

a2aproject a2a-python up to 1.1.3

Timeline

2026-09-14: disclosed: Published in NVD
2026-09-03: patched: Fixed in version 1.1.4 via PR #1164

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.