PatchSiren cyber security CVE debrief

CVE-2026-115419 AWS CVE debrief

CVE-2026-115419: Exposure of data element to wrong session in Strands Agents SDK A2A Server allows authenticated remote users to access conversation history or influence model behavior across sessions in multi-tenant deployments. The Strands Agents SDK's A2A server did not properly isolate conversation state between callers, allowing unintended data disclosure. Defenders of multi-tenant deployments using Strands Agents SDK should assess exposure and upgrade to patched versions to prevent unintended data disclosure.

Vendor: AWS
Product: strands-agents
CVSS: HIGH 8.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-23
Original CVE updated: 2026-10-23
Advisory published: 2026-10-23
Advisory updated: 2026-10-23

Who should care

Defenders of multi-tenant deployments using Strands Agents SDK should assess exposure and upgrade to patched versions to prevent unintended data disclosure. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the secure deployment and operation of Strands Agents SDK in multi-tenant environments.

Why it matters

CVE-2026-115419 allows authenticated remote users to access conversation history or influence model behavior across sessions in multi-tenant Strands Agents SDK deployments. Defenders should assess exposure, verify conversation history isolation, and upgrade to patched versions.

Authenticated remote users can access conversation history across sessions
Authenticated remote users can influence model behavior across sessions
Conversation history isolation requires verification
Upgrade to patched versions is recommended

Technical summary

The Strands Agents SDK's A2A server did not properly isolate conversation state between callers, allowing authenticated remote users to access another caller's conversation history or influence model behavior in multi-tenant deployments. This issue has been addressed in strands-agents version 1.43.0 and @strands-agents/sdk version 1.5.0. The A2A server now uses an agent factory so conversation state is isolated per A2A context_id. Defenders should assess exposure and upgrade to patched versions to prevent unintended data disclosure.

Defensive priority

Upgrade to patched versions, assess multi-tenant deployment exposure

Recommended defensive actions

Upgrade strands-agents to version 1.43.0 or later
Upgrade @strands-agents/sdk to version 1.5.0 or later
Assess multi-tenant deployment exposure
Verify conversation history isolation
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Strands Agents SDK issue allows authenticated remote users to access conversation history or influence model behavior across sessions in multi-tenant deployments. This affects Python versions before 1.43.0 and TypeScript versions before 1.5.0. Defenders should verify conversation history isolation and assess exposure to ensure proper mitigation.

Sources and references

Verified primary and authoritative sources

CVE-2026-115419 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-115419

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-115419 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-115419

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
Unverified legacy reference

URL: https://storage.googleapis.com/osv-vulnerabilities/PyPI/GHSA-4v6f-7vjh-6x4m.json

osv_dev
Source reference
Unverified legacy reference

URL: https://github.com/strands-agents/harness-sdk/security/advisories/GHSA-4v6f-7vjh-6x4m

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/strands-agents/harness-sdk/pull/2628

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/strands-agents/harness-sdk/pull/2696

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/strands-agents/harness-sdk/commit/398343faad0e485f2e441dab70355c9a52382537

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/strands-agents/harness-sdk/commit/403d87847e738e1c73909858d989cedcb67f0afa

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/strands-agents/harness-sdk/commit/f8ba9376fe4b8330d526b6480b47c4440150e0cd

Supplemental source
Source reference
Unverified legacy reference

URL: https://aws.amazon.com/security/security-bulletins/2026-146-aws

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.