A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
A2aproject
  • A2a-java

No data.

No data.

References
Link Providers
https://github.com/a2aproject/a2a-java/ cve-icon cve-icon
https://github.com/a2aproject/a2a-java/commit/6b8e1e085c35e970ef0048901cd25850e4791ec2 cve-icon cve-icon
https://github.com/a2aproject/a2a-java/pull/1045 cve-icon cve-icon
https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final cve-icon cve-icon
https://vuldb.com/cve/CVE-2026-117507 cve-icon cve-icon
https://vuldb.com/submit/1015060 cve-icon cve-icon
https://vuldb.com/vuln/427074 cve-icon cve-icon
https://vuldb.com/vuln/427074/cti cve-icon cve-icon
History

Mon, 02 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded.
Title a2aproject a2a-java TaskManager.saveTaskEvent race condition
First Time appeared A2aproject
A2aproject a2a-java
Weaknesses CWE-362
CPEs cpe:2.3:a:a2aproject:a2a-java:*:*:*:*:*:*:*:*
Vendors & Products A2aproject
A2aproject a2a-java
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-27T15:00:21.118Z

Updated: 2026-11-02T19:21:03.858Z

Reserved: 2026-10-27T08:47:34.610Z

Link: CVE-2026-117507

cve-icon Vulnrichment

Updated: 2026-11-02T19:20:46.631Z

cve-icon NVD

Status : Deferred

Published: 2026-10-27T15:16:57.647

Modified: 2026-11-02T20:17:34.153

Link: CVE-2026-117507

cve-icon Redhat

No data.