Description
The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id.



To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript).
Published: 2026-10-22
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Information disclosure and model manipulation across tenants
Action: Immediate Patch
AI Analysis

Impact

The A2A server component in Amazon Strands Agents SDK for Python prior to 1.43.0 and for TypeScript prior to 1.5.0 fails to isolate conversation state between callers. An authenticated remote user can read other tenants' conversation history and persistently add instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id.

Affected Systems

AWS Strands Agents SDK for Python versions earlier than 1.43.0 and AWS Strands Agents SDK for TypeScript versions earlier than 1.5.0.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the potential for data leakage and model tampering remains substantial. The attack can be launched by any authenticated user who can send HTTP requests to the A2A endpoint, only requiring the ability to specify a different context_id. Consequently, the risk is considered high for environments where the SDK is exposed to multiple tenants.

Generated by OpenCVE AI on October 23, 2026 at 03:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to strands-agents 1.43.0 for Python or @strands-agents/sdk 1.5.0 for TypeScript.
  • Revoke and regenerate credentials for any accounts that performed A2A requests prior to applying the patch.
  • Configure the A2A endpoint to enforce strict context isolation and restrict access to only trusted service accounts.
  • Audit logs for unusual context_id usage to detect potential abuse.

Generated by OpenCVE AI on October 23, 2026 at 03:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id. To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript).
Title Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
First Time appeared Aws
Aws strands-agents
Aws strands-agents Sdk
Weaknesses CWE-488
CPEs cpe:2.3:a:aws:strands-agents:*:*:*:*:*:*:*:*
cpe:2.3:a:aws:strands-agents_sdk:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws strands-agents
Aws strands-agents Sdk
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Aws Strands-agents Strands-agents Sdk
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-10-22T20:04:04.191Z

Reserved: 2026-10-22T13:19:51.802Z

Link: CVE-2026-115419

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-22T21:17:17.790

Modified: 2026-10-22T21:17:17.790

Link: CVE-2026-115419

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T03:45:16Z

Weaknesses
  • CWE-488

    Exposure of Data Element to Wrong Session