Vulnerability / research

Strands A2A isolation flaw could expose other callers’ history

Reported

Published here

What happened

In multi-tenant Strands Agents A2A deployments, an authenticated caller could read another caller’s conversation history and influence their agent’s behavior because conversation state was shared across different context IDs.

Parties and reporting

AI tools and systems: Strands Agents SDK for Python, Strands Agents SDK for TypeScript, Agent2Agent (A2A) server

Outcome

CVE-2026-115419 is patched in Python 1.43.0 and TypeScript 1.5.0. Operators must upgrade; AWS advises separate A2A instances per user or tenant until then.

Operating lesson

Test conversation isolation across callers, and keep each tenant’s agent state separate even when requests use different context IDs.

Evidence and limits

A disclosed vulnerability, not a confirmed intrusion. Authentication and an A2A instance shared by multiple callers are prerequisites. No malicious exploitation is reported in these sources. A vendor patch does not establish that all deployments have upgraded.

Sources