CVE-2026-115419 in strands-agents-sdk
Summary
by MITRE • 10/23/2026
The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id.
To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in Amazon Strands Agents SDK versions prior to 1.43.0 for Python and 1.5.0 for TypeScript represents a critical failure in multi-tenant isolation within the Agent-to-Agent communication framework. This flaw, classified under CWE-284 Improper Access Control, stems from an insufficient separation of conversation state between different callers interacting with the A2A server component. In cloud-native environments and agent orchestration systems, maintaining strict tenant boundaries is paramount to prevent data leakage and unauthorized influence over AI model behavior. The architecture relies on context identifiers to delineate separate conversational threads or sessions for distinct users or services. However, due to a logic error in how these contexts are managed, the system fails to enforce proper isolation when processing HTTP requests directed at the A2A endpoint.
An authenticated remote user can exploit this misconfiguration by manipulating the context_id parameter within their HTTP requests. By supplying a context_id that belongs to another tenant or session, the attacker gains unauthorized access to sensitive information stored in that isolated conversation history. This allows for the exfiltration of proprietary data, personal identifiable information, or other confidential details exchanged during previous interactions. Beyond mere data leakage, the vulnerability enables more severe operational impacts through prompt injection attacks. The attacker can inject persistent instructions into another tenant's context, effectively altering how the AI model behaves in subsequent turns within that session. This capability allows for unauthorized control over the agent's output, potentially leading to the generation of harmful content, execution of unintended logic, or manipulation of downstream systems connected to the agent.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Data Exfiltration and Command and Control via Application Layer Protocol. The ability to read other tenants' data constitutes an unauthorized access vector that compromises confidentiality, while the insertion of persistent instructions represents a form of prompt injection or model manipulation that undermines integrity and availability. Such actions can erode trust in automated systems and lead to significant reputational damage and regulatory non-compliance for organizations relying on these SDKs for production workloads involving sensitive data processing.
To mitigate this risk, immediate action is required by upgrading the affected components. Users of the Python-based Amazon Strands Agents SDK must upgrade to version 1.43.0 or later, while TypeScript users should update their @strands-agents/sdk dependency to version 1.5.0 or higher. These updated versions contain patches that enforce strict isolation of conversation state based on context identifiers, ensuring that each authenticated user can only access and modify data within their own designated session boundaries. Organizations should also implement rigorous input validation and monitoring for anomalous patterns in HTTP requests targeting the A2A endpoint to detect potential exploitation attempts during the transition period.