Strands Agents SDK: an A2A server mixed up callers' chat history

01What happened

The Strands Agents project published advisory GHSA-4v6f-7vjh-6x4m on 22 October 2026 for CVE-2026-115419, a session crossover flaw in the A2A server. GitHub reviewed the advisory and added it to its database on 23 October. The advisory names no outside reporter and directs security reports to AWS Security.

02How it works

An A2A server keys each conversation to the caller's context_id. Under some conditions the Strands server reused one agent instance across requests, so two callers with different context_id values shared a single conversation history. The published fix introduces an agent factory, which builds separate state per context_id. GitHub classes the flaw as CWE-488, exposure of a data element to the wrong session.

03Who is affected

Multi-tenant A2A deployments running strands-agents below 1.43.0 or @strands-agents/sdk below 1.5.0 are exposed. A server with one user is not. Beyond reading another caller's history, the advisory says an authenticated remote caller could influence the model's behavior for other callers.

04What to do

Run strands-agents 1.43.0 or later, or @strands-agents/sdk 1.5.0 or later. The advisory states that no workaround fully addresses the issue, and advises running a separate server instance per user or tenant until you upgrade.

Questions people ask

Which Strands Agents versions fix CVE-2026-115419?

The advisory lists strands-agents 1.43.0 for the Python package and @strands-agents/sdk 1.5.0 for the npm package as the patched versions. PyPI dates strands-agents 1.43.0 to 12 June 2026, and shows 1.62.0, released 21 October 2026, as current. Running a recent release therefore already includes the A2A isolation fix.

Am I affected if my Strands A2A server serves only one user?

A single-tenant Strands Agents A2A server is not meaningfully exposed. CVE-2026-115419 leaks conversation history between callers holding different context_id values, so the impact the advisory describes, reading another caller's history or steering the model for them, requires more than one caller or tenant on the same server instance.

Is there a workaround for the Strands A2A session crossover?

No workaround fully addresses CVE-2026-115419, according to the advisory. Until operators upgrade, it advises not exposing an A2A server to more than one user or tenant, and running a separate server instance per tenant when several callers need access. The permanent fix is an agent factory that isolates conversation state per context_id.

Sources 3 links, all fetched

1. 1github.comProject Advisory
2. 2github.comGitHub Advisory DB
3. 3pypi.orgstrands-agents On PyPI