CVE-2026-115419

{
  "etk_id": "ETK-2026-2496",
  "cve_id": "CVE-2026-115419",
  "display_id": "CVE-2026-115419",
  "ghsa_id": "GHSA-4v6f-7vjh-6x4m",
  "euvd_id": "EUVD-2026-108507",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Conversation-state isolation flaw in strands-agents A2A server",
  "summary": "The A2A server in strands-agents before 1.43.0 for Python and @strands-agents/sdk before 1.5.0 for TypeScript can mix conversation state between tenants. An authenticated caller with access to the A2A HTTP endpoint may view another tenant's conversation history or cause persistent instructions to affect later callers by referencing a different conversation context.",
  "mitigation": "Upgrade Python strands-agents to 1.43.0 or later, and upgrade TypeScript @strands-agents/sdk to 1.5.0 or later. Restrict access to the A2A endpoint to trusted authenticated users until upgrades are complete.",
  "vendor": "AWS",
  "product": "strands-agents",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.43.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "1.43.0"
      ],
      "package_name": "strands-agents",
      "purl": "pkg:pypi/strands-agents"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.5.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.5.0"
      ],
      "package_name": "@strands-agents/sdk",
      "purl": "pkg:npm/@strands-agents/sdk"
    }
  ],
  "cwes": [
    488
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.321072733333333,
  "t0_at": "2026-10-22T20:04:04.191000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-22T20:04:04.191000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T20:04:04.191000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115419"
    }
  }
}