An A2A service can authenticate a request while still misrouting it into another user’s live agent state. The Strands Agents SDK advisory describes precisely this problem: server-side conversation history was shared across calls with different context_id values, so an authenticated remote caller could read prior interactions or alter how the model responded…
Inspect the ClaimsCase · DiggingBeagle record
Strands A2A server shared agent conversation state across tenant contexts
CVE-2026-115419 allowed authenticated users of a shared Strands Agents A2A server to see or influence another caller’s conversation history. Fixed releases use isolated agent instances per context instead of trusting a different context_id as an effective tenant boundary.
Scope
Strands Agents Python and TypeScript A2A servers with more than one caller or tenant. Technical vulnerability confirmed by maintainer advisory; no production victim count has been published.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade A
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Maintainer documentation establishes cross-caller conversation-state aliasing and affected/fixed boundaries. No production victim or exploitation count is known.
Assessed Oct 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-STRANDS-A2A-SESSION · CLM-STRANDS-A2A-VERSIONS · CLM-STRANDS-A2A-MITIGATION · Strands Agents SDK advisory: A2A context_id session data disclosure
At a glance
Authentication alone cannot guarantee tenant separation if the server shares the agent object or mutable chat history. The advisory describes an actual isolation design flaw with fixed SDK releases, but it does not name production victims or evidence of financially material downstream actions.
Read the implicationsThe number of deployments that permitted cross-tenant calls is not known. The published advisory establishes vulnerability, not confirmed production exfiltration.
Limits and uncertaintyFull account
An A2A service can authenticate a request while still misrouting it into another user’s live agent state. The Strands Agents SDK advisory describes precisely this problem: server-side conversation history was shared across calls with different context_id values, so an authenticated remote caller could read prior interactions or alter how the model responded to subsequent users.
The difference between a context identifier and an isolation principal is central. A caller-supplied context_id is useful for routing a conversation, but an application must independently bind that context to authorized caller identity and a separate server-side state container. The reported repair creates isolated agent instances through an agent factory per A2A context.
CVE-2026-115419 affects the Python SDK versions carrying multiagent.a2a before 1.43.0 and the TypeScript SDK before 1.5.0. Maintainers say there is no complete affected-version workaround for a shared multi-tenant endpoint; individual per-user instances or upgrading are the supported options. The advisory does not report a named customer breach, stolen production secrets, or an observed malicious campaign.
Primary advisory: https://github.com/strands-agents/harness-sdk/security/advisories/GHSA-4v6f-7vjh-6x4m
Strands' advisory makes the boundary unusually clear: changing context_id was insufficient because the server could reuse the same mutable agent state for different authenticated callers. This creates both a confidentiality risk (another user's conversation is observable) and an integrity risk (new input can contaminate that conversation). The fix constructs an isolated agent for each A2A context rather than merely filtering message displays. The maintainers give patched versions 1.43.0 for Python and 1.5.0 for TypeScript and say there is no complete workaround for a shared vulnerable instance. The CVSS 8.1 rating is a severity classification, not a measured number of compromised deployments. Upstream advisory.
Mechanism and trust boundary
- 01
Run an A2A agent server with multiple callers
The affected Python or TypeScript Strands SDK A2A server handles remote messages tied to context_id values.
Boundary: Authenticated remote caller / agent session identity
- 02
Reuse conversation state across context identifiers
The server bound different callers to shared agent history instead of a per-context instance, despite each call carrying a distinct identifier.
Boundary: A2A context_id / mutable model conversation state
- 03
Read or influence another caller’s session
A signed-in caller could encounter other users’ conversation content or bias subsequent model behavior without needing to compromise the model weights.
Boundary: Tenant chat history / cross-user model decisions
Timeline
- Oct 22, 2026Event type unspecified
Cross-session A2A flaw disclosed
The SDK advisory identified the missing session isolation and published language-specific fixed releases.
- Oct 22, 2026disclosure
Public disclosure
Claims & evidence
CLM-STRANDS-A2A-SESSIONThe Strands A2A server could share agent conversation history across callers using different context_id values, permitting an authenticated remote user in a multi-tenant deployment to read another caller’s history or influence subsequent responses.supported
Basis: reported finding
- supportsStrands Agents SDK advisory: A2A context_id session data disclosureprimary disclosure
Summary; Impact: A2A server did not properly isolate conversation state between callers
CLM-STRANDS-A2A-VERSIONSAffected implementations were Python strands-agents versions containing multiagent.a2a before 1.43.0, and TypeScript @strands-agents/sdk before 1.5.0; both releases implement per-context agent-factory isolation.supported
Basis: reported finding
- supportsStrands Agents SDK advisory: A2A context_id session data disclosureprimary disclosure
Impacted versions and Patches
CLM-STRANDS-A2A-MITIGATIONThe project states that affected multi-tenant servers have no complete workaround except upgrading or running a separate A2A server instance per caller or tenant.supported
Basis: reported finding
- supportsStrands Agents SDK advisory: A2A context_id session data disclosureprimary disclosure
Workarounds: do not expose affected shared A2A server to multiple users or tenants
CLM-STRANDS-ENRICH-WORKAROUNDThe advisory says there is no complete workaround for affected shared-server versions; Python 1.43.0 and TypeScript 1.5.0 introduce per-A2A-context agent factories.supported
Basis: reported finding
- supportsStrands Agents SDK advisory: A2A context_id session data disclosureprimary disclosure
Patches and workarounds
CLM-STRANDS-ENRICH-PREREQUISITESThe maintainer says the cross-session state flaw requires an A2A service reachable by more than one user or tenant; an authenticated caller may read or influence another caller’s conversation.supported
Basis: reported finding
- supportsStrands Agents SDK advisory: A2A context_id session data disclosureprimary disclosure
Description; Impact; A2A context_id state sharing
Implications
Authentication alone cannot guarantee tenant separation if the server shares the agent object or mutable chat history. The advisory describes an actual isolation design flaw with fixed SDK releases, but it does not name production victims or evidence of financially material downstream actions.
Controls and mitigations
- Upgrade strands-agents Python to 1.43.0 and @strands-agents/sdk to 1.5.0. The maintainer reports no complete workaround in vulnerable shared deployments; isolate each user on separate A2A instances until upgraded and validate per-context factory construction.
Unknowns and contradictions
- The number of deployments that permitted cross-tenant calls is not known.
- The published advisory establishes vulnerability, not confirmed production exfiltration.
Sources and citation
Material revision history
- Oct 24, 2026 · Canonical change recorded · new in release · revision 188