# Strands Agents SDK: an A2A server mixed up callers' chat history

> The Strands Agents A2A server reused conversation state instead of isolating it per context_id.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Strands Agents
- **Disclosed:** 2026-10-22
- **CVE:** CVE-2026-115419
- **CVSS:** 8.6
- **Affects:** Strands Agents SDK, strands-agents (PyPI), @strands-agents/sdk (npm)
- **Research by:** [Strands Agents maintainers](https://github.com/strands-agents) (AWS)
- **Primary source:** https://github.com/strands-agents/harness-sdk/security/advisories/GHSA-4v6f-7vjh-6x4m
- **Page:** https://theinjection.dev/items/strands-agents-a2a-session-crossover/

The Strands Agents SDK A2A server shared conversation history across callers with different context_id values, so an authenticated user in a multi-tenant deployment could read another caller's history. Patched.

## What happened

The Strands Agents project published advisory GHSA-4v6f-7vjh-6x4m on 22 October 2026 for CVE-2026-115419, a session crossover flaw in the A2A server. GitHub reviewed the advisory and added it to its database on 23 October. The advisory names no outside reporter and directs security reports to AWS Security.

## How it works

An A2A server keys each conversation to the caller's context_id. Under some conditions the Strands server reused one agent instance across requests, so two callers with different context_id values shared a single conversation history. The published fix introduces an agent factory, which builds separate state per context_id. GitHub classes the flaw as CWE-488, exposure of a data element to the wrong session.

## Who is affected

Multi-tenant A2A deployments running strands-agents below 1.43.0 or @strands-agents/sdk below 1.5.0 are exposed. A server with one user is not. Beyond reading another caller's history, the advisory says an authenticated remote caller could influence the model's behavior for other callers.

## What to do

Run strands-agents 1.43.0 or later, or @strands-agents/sdk 1.5.0 or later. The advisory states that no workaround fully addresses the issue, and advises running a separate server instance per user or tenant until you upgrade.

## Quick facts

- **Affected:** strands-agents < 1.43.0, @strands-agents/sdk < 1.5.0
- **Fixed in:** strands-agents 1.43.0, @strands-agents/sdk 1.5.0
- **Fix age:** PyPI dates strands-agents 1.43.0 to 12 June 2026
- **Current release:** strands-agents 1.62.0, 21 October 2026
- **CVE:** CVE-2026-115419, CVSS 8.6 (v4.0), High
- **Attack type:** Exposure of data element to wrong session, CWE-488
- **Disclosed:** 22 October 2026 by the project

## Questions

### Which Strands Agents versions fix CVE-2026-115419?

The advisory lists strands-agents 1.43.0 for the Python package and @strands-agents/sdk 1.5.0 for the npm package as the patched versions. PyPI dates strands-agents 1.43.0 to 12 June 2026, and shows 1.62.0, released 21 October 2026, as current. Running a recent release therefore already includes the A2A isolation fix.

### Am I affected if my Strands A2A server serves only one user?

A single-tenant Strands Agents A2A server is not meaningfully exposed. CVE-2026-115419 leaks conversation history between callers holding different context_id values, so the impact the advisory describes, reading another caller's history or steering the model for them, requires more than one caller or tenant on the same server instance.

### Is there a workaround for the Strands A2A session crossover?

No workaround fully addresses CVE-2026-115419, according to the advisory. Until operators upgrade, it advises not exposing an A2A server to more than one user or tenant, and running a separate server instance per tenant when several callers need access. The permanent fix is an agent factory that isolates conversation state per context_id.

## Sources

1. [Project Advisory](https://github.com/strands-agents/harness-sdk/security/advisories/GHSA-4v6f-7vjh-6x4m)
2. [GitHub Advisory DB](https://github.com/advisories/GHSA-4v6f-7vjh-6x4m)
3. [strands-agents On PyPI](https://pypi.org/project/strands-agents/)