CVE-2026-115419: @strands-agents/sdk A2A session leak

Q: Is CVE-2026-115419 actively exploited?

No confirmed active exploitation of CVE-2026-115419 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-115419?

1) Upgrade strands-agents to 1.43.0 or later (Python) and @strands-agents/sdk to 1.5.0 or later (TypeScript). The fix uses an agent factory so state is isolated per context_id. 2) Patch any forks or derivative code to include the upstream changes (PRs 2628 and 2696). 3) Until patched, do not expose an A2A server to more than one user or tenant, and run one server instance per user or tenant. 4) Inventory services that import multiagent.a2a, and restrict network access to A2A endpoints to trusted callers. 5) Review A2A logs for requests where one identity uses many or unexpected context_id values, or where responses reference content from other sessions. 6) Treat data held in shared sessions as potentially exposed and assess whether disclosure notification or credential rotation is needed.

Q: What systems are affected by CVE-2026-115419?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, agent-to-agent (A2A) servers, multi-tenant AI agent deployments.

Q: What is the CVSS score for CVE-2026-115419?

CVE-2026-115419 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.43%.

CISO Take

Strands Agents SDK, an AWS-backed open-source framework for building AI agents, has a flaw in its Agent2Agent (A2A) server. It shares conversation state between callers with different context_id values, so one authenticated user can read, and inject into, another user's agent session (CVSS 8.1, high). The risk is highest in multi-tenant or shared A2A deployments, where leaked histories can contain prompts, business data, and tool outputs, and where injected context can steer the agent's behavior for other tenants. No public exploit, Nuclei template, or KEV listing exists and no EPSS score is available yet, but exploitation needs only low privileges and no special skill. Upgrade strands-agents (Python) to 1.43.0 or later and @strands-agents/sdk (TypeScript) to 1.5.0 or later. Until then, run a separate A2A server instance per user or tenant, because no other workaround fully fixes the issue.

Sources:NVDGitHub Advisoryaws.amazon.comATLAS

What is the risk?

High. The CVSS 8.1 vector is network-reachable, low complexity, low privileges, and no user interaction, with high confidentiality and integrity impact. No active exploitation is known: it is not in CISA KEV, there is no public exploit or scanner template, and EPSS is unavailable. Exposure is limited to deployments where an A2A server serves more than one user or tenant. Single-tenant or internal-only deployments carry much lower risk. Because attackers need only an authenticated session and a request that triggers the shared state, the exploitation bar is low once an A2A endpoint is reachable.

How does the attack unfold?

Initial Access

The attacker authenticates to a shared A2A server as a low-privilege user or tenant.

AML.T0012

Session Data Access

The attacker sends requests with their own context_id and the server returns or uses conversation history shared with other callers.

AML.T0085

Context Injection

The attacker writes malicious or misleading content into the shared history, which the model then treats as context for other callers.

AML.T0080.001

Impact

Other tenants' conversation data is exposed, and agent responses or tool actions for those tenants are manipulated.

AML.T0048.003

Initial Access

The attacker authenticates to a shared A2A server as a low-privilege user or tenant.

AML.T0012

Session Data Access

The attacker sends requests with their own context_id and the server returns or uses conversation history shared with other callers.

AML.T0085

Context Injection

The attacker writes malicious or misleading content into the shared history, which the model then treats as context for other callers.

AML.T0080.001

Impact

Other tenants' conversation data is exposed, and agent responses or tool actions for those tenants are manipulated.

AML.T0048.003

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
@strands-agents/sdk	npm	< 1.5.0	`1.5.0`
strands-agents	pip	< 1.43.0	`1.43.0`

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade strands-agents to 1.43.0 or later (Python) and @strands-agents/sdk to 1.5.0 or later (TypeScript). The fix uses an agent factory so state is isolated per context_id. 2) Patch any forks or derivative code to include the upstream changes (PRs 2628 and 2696). 3) Until patched, do not expose an A2A server to more than one user or tenant, and run one server instance per user or tenant. 4) Inventory services that import multiagent.a2a, and restrict network access to A2A endpoints to trusted callers. 5) Review A2A logs for requests where one identity uses many or unexpected context_id values, or where responses reference content from other sessions. 6) Treat data held in shared sessions as potentially exposed and assess whether disclosure notification or credential rotation is needed.

How is it classified?

Data LeakageAuth BypassAgentFrameworkAML.T0012- Valid Accounts AML.T0080- AI Agent Context Poisoning AML.T0080.001- Thread AML.T0085- Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Responding to and recovering from unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-115419?

Strands Agents SDK, an AWS-backed open-source framework for building AI agents, has a flaw in its Agent2Agent (A2A) server. It shares conversation state between callers with different context_id values, so one authenticated user can read, and inject into, another user's agent session (CVSS 8.1, high). The risk is highest in multi-tenant or shared A2A deployments, where leaked histories can contain prompts, business data, and tool outputs, and where injected context can steer the agent's behavior for other tenants. No public exploit, Nuclei template, or KEV listing exists and no EPSS score is available yet, but exploitation needs only low privileges and no special skill. Upgrade strands-agents (Python) to 1.43.0 or later and @strands-agents/sdk (TypeScript) to 1.5.0 or later. Until then, run a separate A2A server instance per user or tenant, because no other workaround fully fixes the issue.

Is CVE-2026-115419 actively exploited?

No confirmed active exploitation of CVE-2026-115419 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115419?

1) Upgrade strands-agents to 1.43.0 or later (Python) and @strands-agents/sdk to 1.5.0 or later (TypeScript). The fix uses an agent factory so state is isolated per context_id. 2) Patch any forks or derivative code to include the upstream changes (PRs 2628 and 2696). 3) Until patched, do not expose an A2A server to more than one user or tenant, and run one server instance per user or tenant. 4) Inventory services that import multiagent.a2a, and restrict network access to A2A endpoints to trusted callers. 5) Review A2A logs for requests where one identity uses many or unexpected context_id values, or where responses reference content from other sessions. 6) Treat data held in shared sessions as potentially exposed and assess whether disclosure notification or credential rotation is needed.

What systems are affected by CVE-2026-115419?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, agent-to-agent (A2A) servers, multi-tenant AI agent deployments.

What is the CVSS score for CVE-2026-115419?

CVE-2026-115419 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemsagent-to-agent (A2A) serversmulti-tenant AI agent deployments

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0080AI Agent Context Poisoning

AML.T0080.001Thread

AML.T0085Data from AI Services

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

**Summary** Strands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents/sdk), for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent (A2A) server shares conversation history across callers with different context\_id values, allowing one caller to read and influence another caller's session. **Impact** The A2A server did not properly isolate conversation state between callers. In multi-tenant deployments, an authenticated remote user could access another caller's conversation history or influence model behavior for other callers (CWE-488: Unintended Disclosure of Data Element to Wrong Session). This affects any deployment where an A2A server is reachable by more than one user or tenant. **Impacted versions:** strands-agents (Python): all versions containing the multiagent.a2a module, < 1.43.0 @strands-agents/sdk (TypeScript): < 1.5.0 **Patches** This issue has been addressed in strands-agents version 1.43.0 and @strands-agents/sdk version 1.5.0. The A2A server now uses an agent factory so conversation state is isolated per A2A context\_id. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. **Workarounds** There is no workaround that fully addresses this issue in affected versions. Until you upgrade, do not expose an A2A server to more than one user or tenant. If multiple callers need access, run a separate A2A server instance for each user or tenant. **References** If you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

Exploitation Scenario

A SaaS provider hosts a customer-support agent built on Strands Agents and exposes one A2A server to many tenants. An attacker with a low-privilege tenant account sends requests to the A2A endpoint with their own context_id. Because the server keeps a single shared history, the model's context includes other tenants' earlier conversations, and the attacker prompts the agent to summarize or repeat them, exposing customer data. The attacker then plants instructions in the shared history, such as false facts or directives to call tools in a certain way. Those instructions influence how the agent answers and acts for other tenants.

Weaknesses (CWE)

CWE-488Exposure of Data Element to Wrong SessionPrimary CWE-488Exposure of Data Element to Wrong Session

CWE-488 — Exposure of Data Element to Wrong Session: The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

[Architecture and Design] Protect the application's sessions from information leakage. Make sure that a session's data is not used or visible by other sessions.
[Testing] Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton Member Field).

Source: MITRE CWE corpus.