CVE-2026-115419

Strands A2A conversation state crosses tenant boundaries

AWS / Strands Agents · Strands Agents SDK

First documented disclosure · Review checkpoint

Summary

A shared A2A server could expose another caller’s conversation history and accept instructions that affect later callers.

Severity and exploitation evidence

High · 8.6/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Conversation state was not isolated between A2A contexts.

Conditions required

Authenticated access to an A2A instance serving multiple users or tenants.

Potential impact

Cross-tenant information disclosure and manipulation of agent behavior.

Affected versions and configurations

Python strands-agents with the A2A module before 1.43.0; TypeScript @strands-agents/sdk before 1.5.0.

Fix and mitigation status

Python 1.43.0; TypeScript 1.5.0.

Practical next steps

Upgrade both applicable SDKs; until then run separate A2A instances per user or tenant.

Operating lesson

Treat conversation state as tenant data and test isolation across caller identities.

Evidence and limits

CNA CVSS 4.0 is 8.6; the upstream advisory also provides CVSS 3.1 at 8.1. Neither score measures observed attacks.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources