Description
The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id.



To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript).
Published: 2026-10-22
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Information disclosure and model manipulation across tenants
Action: Immediate Patch
AI Analysis

Impact

The A2A server component in Amazon Strands Agents SDK for Python prior to 1.43.0 and for TypeScript prior to 1.5.0 fails to isolate conversation state between callers. An authenticated remote user can read other tenants' conversation history and persistently add instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id.

Affected Systems

AWS Strands Agents SDK for Python versions earlier than 1.43.0 and AWS Strands Agents SDK for TypeScript versions earlier than 1.5.0.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the potential for data leakage and model tampering remains substantial. The attack can be launched by any authenticated user who can send HTTP requests to the A2A endpoint, only requiring the ability to specify a different context_id. Consequently, the risk is considered high for environments where the SDK is exposed to multiple tenants.

Generated by OpenCVE AI on October 23, 2026 at 03:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to strands-agents 1.43.0 for Python or @strands-agents/sdk 1.5.0 for TypeScript.
  • Revoke and regenerate credentials for any accounts that performed A2A requests prior to applying the patch.
  • Configure the A2A endpoint to enforce strict context isolation and restrict access to only trusted service accounts.
  • Audit logs for unusual context_id usage to detect potential abuse.

Generated by OpenCVE AI on October 23, 2026 at 03:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-4v6f-7vjh-6x4m Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
History

Sat, 31 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id. To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript).
Title Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
First Time appeared Aws
Aws strands-agents
Aws strands-agents Sdk
Weaknesses CWE-488
CPEs cpe:2.3:a:aws:strands-agents:*:*:*:*:*:*:*:*
cpe:2.3:a:aws:strands-agents_sdk:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws strands-agents
Aws strands-agents Sdk
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Aws Strands-agents Strands-agents Sdk
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-10-30T19:30:50.901Z

Reserved: 2026-10-22T13:19:51.802Z

Link: CVE-2026-115419

cve-icon Vulnrichment

Updated: 2026-10-30T19:30:45.970Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T21:17:17.790

Modified: 2026-10-30T20:17:01.600

Link: CVE-2026-115419

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-10T08:45:15Z

Weaknesses
  • CWE-488

    Exposure of Data Element to Wrong Session