{"data":{"id":"99353f8e-2f45-4e66-be3a-5c1ce6572855","title":"CVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server","summary":"CVE-2026-115419 affects the Agent2Agent (A2A) server component of the Strands Agents SDK, which exposes an agent over HTTP. The A2A server did not properly isolate conversation state between callers, so an authenticated remote user could access another caller's conversation history or influence model behavior for other callers in multi-tenant deployments. Impacted versions are strands-agents (Python) containing the multiagent.a2a module below 1.43.0, and @strands-agents/sdk (TypeScript) below 1.5.0.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-146-aws/","publishedAt":"2026-10-22T20:07:11.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["Strands Agents SDK","Strands Agents A2A Server","AWS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-22T20:07:11.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}