Amazon Strands Agents SDK: Cross-session data exposure in A2A server
Summary
The Agent2Agent (A2A) server component of the Strands Agents SDK for Python and TypeScript does not properly isolate conversation state between callers. An authenticated remote user can read the conversation history of other callers and add persistent instructions that change model behavior for later callers, by using a different context_id in HTTP requests. The issue matters most in multi-tenant deployments where one A2A endpoint serves more than one user or tenant.
Affected
- strands-agents (Python): all versions containing the multiagent.a2a module before 1.43.0
- @strands-agents/sdk (TypeScript): versions before 1.5.0
Fixed in
- strands-agents (Python): 1.43.0
- @strands-agents/sdk (TypeScript): 1.5.0
- Conversation state is now isolated per A2A context_id.
Workaround
- No workaround fully addresses the issue in affected versions (per AWS).
- Until upgraded, do not expose an A2A server to more than one user or tenant.
- If multiple callers need access, run a separate A2A server instance for each user or tenant.
- Using the agent_factory pattern is a partial stopgap, not a fix.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No reports of exploitation in the wild and no known-exploited listing found.
- No public proof of concept found in a short search.
Our recommendation
- Identify all uses of the Strands SDK below 1.43.0 (Python) or 1.5.0 (TypeScript), including forked code.
- Upgrade to strands-agents 1.43.0 or @strands-agents/sdk 1.5.0 and rebuild affected containers or images.
- If A2A is not needed, disable or remove the A2A server.
- In multi-tenant setups, run a separate A2A server instance per tenant until the fix is verified.
- Review A2A access logs for unexpected context_id reuse as an investigation step.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-146-AWS aws.amazon.com
- GitHub Security Advisory GHSA-4v6f-7vjh-6x4m github.com
- PyPI strands-agents 1.43.0 pypi.org
- npm @strands-agents/sdk 1.5.0 www.npmjs.com
- INCIBE-CERT alert CVE-2026-115419 www.incibe.es
- Strands Agents SDK documentation: agent-to-agent strandsagents.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:14.
Original description (NVD)
The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id. To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript).
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.