Read the docs
TI-2026-79527 Aliases CVE-2026-115419GHSA-4v6f-7vjh-6x4m

A2A Server in Strands Agents SDK exposes other tenants' data

Priority MEDIUM 40CWE-488Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 do not properly isolate conversation state between callers. An authenticated remote user can read other tenants' conversation history and add persistent instructions that alter model behavior for later callers by sending HTTP requests to the A2A endpoint with a different context_id. The flaw is classified as CWE-488, exposure of a data element to the wrong session.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id. To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00426 37th percentileScored 2026-11-07
Fix Fixed strands-agents (AWS): 1.43.0strands-agents/sdk (AWS): 1.5.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSstrands-agentsbefore 1.43.01.43.0Patch availableCNA
AWSstrands-agents/sdkbefore 1.5.01.5.0Patch availableCNA
—strands-agents (PyPI)before 1.43.01.43.0Patch availableGHSA-4v6f-7vjh-6x4m
—@strands-agents/sdk (npm)before 1.5.01.5.0Patch availableGHSA-4v6f-7vjh-6x4m
  • strands-agents VendorAWS Affected before 1.43.0 Fixed in 1.43.0 Patch available CNA
  • strands-agents/sdk VendorAWS Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
  • strands-agents (PyPI) Vendor— Affected before 1.43.0 Fixed in 1.43.0 Patch available GHSA-4v6f-7vjh-6x4m
  • @strands-agents/sdk (npm) Vendor— Affected before 1.5.0 Fixed in 1.5.0 Patch available GHSA-4v6f-7vjh-6x4m

Remediation

Upgrade strands-agents to 1.43.0 for Python and @strands-agents/sdk to 1.5.0 for TypeScript, which are the fixed versions listed for both packages.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA strands-agents (AWS) Fixed in 1.43.0
  • Fix · CNA strands-agents/sdk (AWS) Fixed in 1.5.0
  • Fix · GHSA-4v6f-7vjh-6x4m strands-agents (PyPI) Fixed in 1.43.0 Advisory →
  • Fix · GHSA-4v6f-7vjh-6x4m @strands-agents/sdk (npm) Fixed in 1.5.0 Advisory →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-115419
  2. 2026-10-23 Priority changed: MEDIUM → LOW
  3. 2026-10-23 Alias added: GHSA-4v6f-7vjh-6x4m
  4. 2026-10-23 Fix available: PyPI/[email protected], npm/@strands-agents/[email protected] · GHSA-4v6f-7vjh-6x4m
  5. 2026-10-23 CVSS score added · GHSA-4v6f-7vjh-6x4m
  6. 2026-10-23 Weakness changed · GHSA-4v6f-7vjh-6x4m
  7. 2026-10-23 13 new references · GHSA-4v6f-7vjh-6x4m
  8. 2026-10-30 CISA SSVC decision points changed
  9. 2026-10-30 Priority changed: LOW → MEDIUM

References

Patch 2

Advisory 3

Other 10

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
  • TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9
See all 383 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences