CVE-2026-115419: Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different contextid.
To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
strands-agentsto a version that resolves this vulnerability.Fixed in 1.43.0 - Upgrade
Upgrade
@strands-agents/sdkto a version that resolves this vulnerability.Fixed in 1.5.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 or TypeScript before 1.5.0 are affected. The issue concerns callers reaching the A2A endpoint over HTTP.
What does an attacker need to exploit this issue?
An attacker needs to be an authenticated remote user able to send HTTP requests to the A2A endpoint. Exploitation involves using a different context_id to access another caller's conversation state.
What could an attacker do?
An authenticated attacker could read conversation history belonging to other tenants. They could also add persistent instructions that change model behavior for subsequent callers.
What should be done to remediate the issue?
Upgrade the Python package strands-agents to version 1.43.0 or later. Upgrade the TypeScript package @strands-agents/sdk to version 1.5.0 or later.