CVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
Bulletin ID: 2026-146-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:00 PM PDT Description: Strands Agents is an open-source SDK, available for Python and TypeScript, for building AI agents. The SDK includes an Agent2Agent (A2A) server component that exposes an agent over HTTP so other agents and clients can call it. We identified CVE-2026-115419, an issue where the A2A server did not properly isolate conversation state between callers. An authenticated remote user could access another caller's conversation history or influence model behavior for other callers in multi-tenant deployments. Impacted versions: - strands-agents (Python): all versions
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services, Node.js
- Product
- Node.js
- Exposure class
- Developer platform
Why it ranks 25 (Notable)
- Product class: developer platform
- Widely deployed vendor product (Amazon Web Services)
- Covered by 2 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-115419 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.