CVE-2026-115419: strands-agents 0 to before 1.43.0; +1 more affected products

Affected technology

strands-agents · 0 to before 1.43.0
AWS

strands-agents/sdk · 0 to before 1.5.0
AWS

Description’s affected range: before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id. Source advisory’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality and integrity impact as high; availability impact as none.