GHSA-4v6f-7vjh-6x4m: High severity npm/@strands-agents/sdk vulnerability
Summary Strands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents/sdk), for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent (A2A) server shares conversation history across callers with different context\id values, allowing one caller to read and influence another caller's session. Impact The A2A server did not properly isolate conversation state between callers. In multi-tenant deployments, an authenticated remote user could access another caller's conversation history or influence model behavior for other callers (CWE-488: Unintended Disclosure of Data Element to Wrong Session). This affects any deployment where an A2A server is reachable by more than one user or tenant. Impacted versions: strands-agents (Python): all versions containing the multiagent.a2a module, < 1.43.0 @strands-agents/sdk (TypeScript): < 1.5.0 Patches This issue has been addressed in strands-agents version 1.43.0 and @strands-agents/sdk version 1.5.0. The A2A server now uses an agent factory so conversation state is isolated per A2A context\id. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds There is no workaround that fully addresses this issue in affected versions. Until you upgrade, do not expose an A2A server to more than one user or tenant. If multiple callers need access, run a separate A2A server instance for each user or tenant. References If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@strands-agents/sdkto a version that resolves this vulnerability.Fixed in 1.5.0 - Upgrade
Upgrade
pip/strands-agentsto a version that resolves this vulnerability.Fixed in 1.43.0 - Upgrade
Upgrade
@strands-agents/sdkto a version that resolves this vulnerability.Fixed in 1.5.0 - Upgrade
Upgrade
strands-agentsto a version that resolves this vulnerability.Fixed in 1.43.0 - Compensating control
Until upgrading, do not expose an A2A server to more than one user or tenant; if multiple callers need access, run a separate A2A server instance for each user or tenant.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Any deployment in which an A2A server is reachable by more than one user or tenant is affected. The risk is cross-session exposure because conversation state may not be isolated between callers using different context_id values.
What does an attacker need to exploit it?
An attacker needs authenticated remote access to the affected A2A server. No user interaction is required.
Which package versions should be upgraded?
Upgrade strands-agents for Python to version 1.43.0 or later, and @strands-agents/sdk for TypeScript to version 1.5.0 or later. Affected Python releases are those containing the multiagent.a2a module before 1.43.0; affected TypeScript releases are before 1.5.0.
What is the practical impact in a multi-tenant environment?
One caller may be able to read another caller's conversation history and influence model behavior in that caller's session. This can expose session data and affect the integrity of agent interactions.