CVE-2026-115419 json
Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
published 2026-10-22 17 d ago modified 2026-10-30 9 d ago also GHSA-4v6f-7vjh-6x4m , EUVD-2026-108507
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id.
To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript).
Patch / fix
- pypi strands-agents 1.43.0
- npm @strands-agents/sdk 1.5.0
- AWS strands-agents 1.43.0
- AWS strands-agents/sdk 1.5.0
- github.com/strands-agents/harness-sdk@398343f commit
- github.com/strands-agents/harness-sdk@403d878 commit
- github.com/strands-agents/harness-sdk@f8ba937 commit
- pypi.org/project/strands-agents/1.43.0/ patch
- npmjs.com/package/@strands-agents/sdk/v/1.5.0 patch
- github.com/strands-agents/harness-sdk#2628 pull request
- github.com/strands-agents/harness-sdk#2696 pull request
- github.com/strands-agents/harness-sdk/releases/tag/python/v1.43.0 release
- github.com/strands-agents/harness-sdk/releases/tag/typescript/v1.5.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 9 d ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | strands-agents | <1.43.0 |
1.43.0 |
| npm | @strands-agents/sdk | <1.5.0 |
1.5.0 |
Affected products
- AWS strands-agents
- AWS strands-agents/sdk
Classification
- Weakness
-
- CWE-488 Exposure of Data Element to Wrong Session
References
-
pypi.org
/project/strands-agents/1.43.0/
release-notes, patch
-
npmjs.com
/package/@strands-agents/sdk/v/1.5.0
release-notes, patch, web
-
github.com
/strands-agents/harness-sdk/pull/2628
web
-
github.com
/strands-agents/harness-sdk/pull/2696
web
-
github.com
/strands-agents/harness-sdk/commit/398343faad0e485f2e441dab70355c9a52382537
web
-
github.com
/strands-agents/harness-sdk/commit/403d87847e738e1c73909858d989cedcb67f0afa
web
-
github.com
/strands-agents/harness-sdk/commit/f8ba9376fe4b8330d526b6480b47c4440150e0cd
web
-
aws.amazon.com
/security/security-bulletins/2026-146-aws/
vendor-advisory
-
github.com
/strands-agents/harness-sdk/security/advisories/GHSA-4v6f-7vjh-6x4m
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-115419
advisory
-
aws.amazon.com
/security/security-bulletins/2026-146-aws
web
-
github.com
/strands-agents/harness-sdk
package
-
github.com
/strands-agents/harness-sdk/releases/tag/python/v1.43.0
web
-
github.com
/strands-agents/harness-sdk/releases/tag/typescript/v1.5.0
web
-
pypi.org
/project/strands-agents/1.43.0
web
Sources
- CVE List CVE-2026-115419
- GitHub Advisory GHSA-4v6f-7vjh-6x4m
- NVD CVE-2026-115419
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.