Strands Agents SDK: A2A server leaks conversation history across tenants (CVE-2026-115419)
Severity: high · Patch status: patched · Since 2026-10-22 · CVE-2026-115419
The Agent2Agent (A2A) server in Strands Agents SDK failed to isolate conversation state between callers, sharing conversation history across callers with different contextid values. In multi-tenant deployments, an authenticated remote user could read another caller's conversation history or influence model behavior for other callers (CWE-488). Any deployment where an A2A server is reachable by more than one user or tenant is affected. No in-the-wild exploitation is known. Fixed versions use an agent factory so conversation state is isolated per A2A contextid; there is no full workaround other than running a separate A2A server instance per user or tenant.
What to do
- Upgrade strands-agents to 1.43.0 or later (Python) and @strands-agents/sdk to 1.5.0 or later (TypeScript)
- Until upgraded, do not expose an A2A server to more than one user or tenant; run a separate A2A server instance per user or tenant if multiple callers need access
- Patch any forked or derivative code to incorporate the upstream fixes
- Review logs for signs of cross-tenant conversation access in multi-tenant deployments
Fixed versions
- strands-agents 1.43.0
- @strands-agents/sdk 1.5.0
Sources
All live incidents on Threat Watch