CVE-2026-90790 Overview
CVE-2026-90790 is a Server-Side Request Forgery (SSRF) vulnerability affecting the a2aproject/a2a-python library through version 1.1.3. The flaw resides in the _dispatch_notification function within src/a2a/server/tasks/base_push_notification_sender.py, part of the Push Notification Sender component. An authenticated attacker can manipulate the push_info.url argument to coerce the server into issuing arbitrary HTTP requests. The issue is classified as CWE-918 and is remotely exploitable over the network. Version 1.1.4 addresses the vulnerability.
Critical Impact
Authenticated remote attackers can force the a2a-python server to issue arbitrary outbound HTTP requests, enabling internal network reconnaissance and interaction with internal services.
Affected Products
- a2aproject/a2a-python versions up to and including 1.1.3
- Component: Push Notification Sender (base_push_notification_sender.py)
- Function: _dispatch_notification
Discovery Timeline
- 2026-09-14 - CVE-2026-90790 published to the National Vulnerability Database
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-90790
Vulnerability Analysis
The vulnerability is a Server-Side Request Forgery (SSRF) condition in the Push Notification Sender subsystem of a2a-python. The _dispatch_notification function dispatches HTTP notifications to a URL derived from the push_info.url argument. Because the library does not adequately validate or restrict the destination URL, a caller controlling push_info.url can direct the server to issue requests to arbitrary internal or external endpoints.
Exploitation permits interaction with services reachable from the a2a-python host, including cloud instance metadata services, internal APIs, and non-routable network segments. The advisory notes limited confidentiality, integrity, and availability impact, consistent with an SSRF that returns constrained response data to the attacker.
Root Cause
The root cause is insufficient validation of the user-supplied push_info.url value before it is passed to the HTTP client inside _dispatch_notification. There is no allowlist of destination hosts, no restriction on private address ranges, and no scheme filtering to block requests to non-HTTP protocols or loopback addresses.
Attack Vector
Exploitation is performed over the network by an authenticated caller who can register or update a push notification target. The attacker supplies a crafted URL for push_info.url pointing to an internal resource. When the server dispatches the notification, it issues an HTTP request to the attacker-chosen destination. See the VulDB entry for CVE-2026-90790 and the upstream fix in Pull Request #1164 for further technical detail.
No verified proof-of-concept code is publicly available. The vulnerability mechanism is described in prose in the referenced advisories; refer to the a2a-python repository for the affected source path.
Detection Methods for CVE-2026-90790
Indicators of Compromise
- Outbound HTTP requests from the a2a-python service to private address ranges (RFC 1918), link-local addresses, or cloud metadata endpoints such as 169.254.169.254.
- Push notification registrations containing unusual URL schemes, non-standard ports, or hostnames resolving to internal infrastructure.
- Repeated failed or redirected notification dispatch attempts targeting varied internal hosts, indicating enumeration.
Detection Strategies
- Instrument the _dispatch_notification code path to log the resolved destination host and IP prior to issuing the outbound request.
- Correlate application-level notification dispatch logs with egress firewall or proxy telemetry to identify SSRF-consistent traffic patterns.
- Alert on push notification configurations submitted by low-privilege accounts that resolve to internal or metadata addresses.
Monitoring Recommendations
- Monitor a2a-python service processes for outbound connections that violate an approved egress destination policy.
- Track version metadata of deployed a2a-python packages and flag any instance at or below 1.1.3.
- Retain HTTP client logs from the notification sender for post-incident review of destination URLs and response codes.
How to Mitigate CVE-2026-90790
Immediate Actions Required
- Upgrade a2a-python to version 1.1.4 or later, which contains the upstream fix.
- Inventory all services embedding a2a-python and prioritize those exposing the Push Notification Sender to untrusted or low-trust callers.
- Restrict egress from hosts running a2a-python to a minimal set of required destinations using network policy or an outbound proxy.
Patch Information
The fix is available in a2a-python release v1.1.4. The relevant upstream changes are tracked in Pull Request #1164 and Pull Request #1169. Upgrading the affected component is the vendor-recommended remediation.
Workarounds
- Enforce an allowlist of permitted destination hosts for push notifications at the application or proxy layer.
- Block outbound requests from the a2a-python host to private, loopback, and link-local address ranges, including the cloud instance metadata service.
- Require validation of the push_info.url scheme and host before accepting or persisting push notification configurations.
# Upgrade a2a-python to the patched release
pip install --upgrade 'a2a-python>=1.1.4'
# Verify installed version
pip show a2a-python | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
