CVE-2026-115419

Name of the Vulnerable Software and Affected Versions Amazon Strands Agents SDK for Python versions prior to 1.43.0 Amazon Strands Agents SDK for TypeScript versions prior to 1.5.0

Description The A2A server component fails to properly isolate conversation state between callers. An authenticated remote user can perform HTTP requests to the A2A endpoint using a different context id to read the conversation history of other tenants or add persistent instructions that modify model behavior for subsequent callers.

Recommendations Upgrade Amazon Strands Agents SDK for Python to version 1.43.0. Upgrade Amazon Strands Agents SDK for TypeScript to version 1.5.0.