Zero Radar
← feed
HighVulnerabilityCVE-2026-115419updated 25 Oct 2026, 13:32 UTC

Strands Agents SDK: callers can see and affect each other's AI chat sessions

If several users or customers talk to the same AI agent server, one user could read another user's conversation history and slip in instructions that change how the AI answers others. Upgrading the SDK fixes it.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesstrands-agents 1.43.0; @strands-agents/sdk 1.5.0 (the A2A server now uses an agent factory to isolate state per context_id) · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Authenticated remote userHas a valid account on the shared server
  2. 2Sends crafted A2A requestsUses a different context_id over HTTP
  3. 3A2A server shares stateConversation state not isolated per caller
  4. 4Reads other tenants' historyPrivate conversations exposed
  5. 5Persistent instructions injectedAlters model behavior for later callers
  6. ResultOther users' data leaked and AI behavior altered

What happened

The Agent2Agent (A2A) server in the Strands Agents SDK (Python strands-agents and TypeScript @strands-agents/sdk) does not properly isolate conversation state between callers that use different context_id values, so an authenticated remote caller can read another caller's history and influence model behavior for them.

Why it is dangerous: Attackers with a valid account on a shared server can see other tenants' private conversation data and plant persistent instructions that alter the AI's responses for later users. Multi-tenant deployments are at highest risk.

Are you affected?

You are affected if you run an A2A server built on strands-agents older than 1.43.0 or @strands-agents/sdk older than 1.5.0 and it is reachable by more than one user or tenant.

Package / productAffected versionsFixed in
strands-agents · pip< 1.43.01.43.0
@strands-agents/sdk · npm< 1.5.01.5.0

What to do

  1. Upgrade strands-agents to 1.43.0 or later (Python)
  2. Upgrade @strands-agents/sdk to 1.5.0 or later (TypeScript)
  3. Patch any forked or derivative copies of the SDK with the same fix
  4. Until upgraded, run a separate A2A server instance for each user or tenant

Timeline

  1. 22 Oct 2026, 21:17 UTC
    Publicly disclosed
  2. 22 Oct 2026, 21:17 UTC
    Reported by NVD · NVD
  3. 23 Oct 2026, 20:48 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115419 · GHSA-4v6f-7vjh-6x4m
CVSS
8.6 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 21:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Strands Agents SDK: callers can see and affect each other's AI chat sessions · Zero Radar