High severity · published Oct 22, 2026
CVE-2026-115419
Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
New
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id.
To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
strands-agents · AWS
before 1.43.0 · source: vendor
ST
strands-agents/sdk · AWS
before 1.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115419
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115419
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-146-aws/
github.com
https://github.com/strands-agents/harness-sdk/security/advisories/GHSA-4v6f-7vjh-6x4m
pypi.org
https://pypi.org/project/strands-agents/1.43.0/
www.npmjs.com
https://www.npmjs.com/package/@strands-agents/sdk/v/1.5.0