CVE-2026-115419: Strands Agents A2A servers shared conversation history between different callers
The Agent2Agent (A2A) server in AWS's Strands Agents SDK didn't isolate conversation state between callers with different context_id values. In a deployment used by more than one user or tenant, an authenticated caller could read another caller's conversation history or steer the model's answers to them. Fixed in strands-agents 1.43.0 (Python) and @strands-agents/sdk 1.5.0 (TypeScript).
What it is
The A2A server kept one agent, and so one conversation history, for everyone instead of one per A2A context_id. A second caller could see what earlier callers had said and been told, and anything they sent became part of the context other callers' answers were built on.
Any deployment where an A2A server is reachable by more than one user or tenant is affected. The fix makes the server build agents from a factory so each context_id gets its own state.
The maintainers say no workaround fully fixes affected versions.
How to check
- Affected: strands-agents (PyPI) before 1.43.0, in versions that include the multiagent.a2a module, and @strands-agents/sdk (npm) before 1.5.0.
- You are at risk if you run a Strands A2A server that more than one user, tenant or outside agent can call.
How to fix
- Upgrade strands-agents to 1.43.0 or later, or @strands-agents/sdk to 1.5.0 or later, and update any forked A2A server code the same way.
- Until you upgrade, don't expose an A2A server to more than one user or tenant.
pip show strands-agents | grep -i version
npm ls @strands-agents/sdk