Strands Agents SDK advisory: A2A context_id session data disclosure

Evidence record

Official Strands Agents SDK security advisory CVE-2026-115419, A2A server shared conversation state across distinct users and context_id values; patched in Python 1.43.0 and TypeScript 1.5.0.

Read the original source ↗

Claim-level citations (5)

• supportsStrands A2A server shared agent conversation state across tenant contexts: The Strands A2A server could share agent conversation history across callers using different context_id values, permitting an authenticated remote user in a multi-tenant deployment to read another caller’s history or influence subsequent responses.

  Summary; Impact: A2A server did not properly isolate conversation state between callers

• supportsStrands A2A server shared agent conversation state across tenant contexts: Affected implementations were Python strands-agents versions containing multiagent.a2a before 1.43.0, and TypeScript @strands-agents/sdk before 1.5.0; both releases implement per-context agent-factory isolation.

  Impacted versions and Patches

• supportsStrands A2A server shared agent conversation state across tenant contexts: The project states that affected multi-tenant servers have no complete workaround except upgrading or running a separate A2A server instance per caller or tenant.

  Workarounds: do not expose affected shared A2A server to multiple users or tenants

• supportsStrands A2A server shared agent conversation state across tenant contexts: The advisory says there is no complete workaround for affected shared-server versions; Python 1.43.0 and TypeScript 1.5.0 introduce per-A2A-context agent factories.

  Patches and workarounds

• supportsStrands A2A server shared agent conversation state across tenant contexts: The maintainer says the cross-session state flaw requires an A2A service reachable by more than one user or tenant; an authenticated caller may read or influence another caller’s conversation.

  Description; Impact; A2A context_id state sharing