AmazonAnalysisAmazon Web Services patches Strands Agents SDK A2A server cross-tenant conversation exposure
What happened.Amazon Web Services published security bulletin AWS-2026-146 addressing a high-severity conversation isolation defect inside the open-source Strands Agents SDK.
Why it matters.Autonomous agent frameworks handle confidential database queries, customer support transcripts, and operational tools across shared endpoints. Cross-tenant context leakage in agent gateways exposes private conversational logs and permits indirect prompt injection. Engineering teams hosting multi-tenant agent endpoints must upgrade their runtime dependencies or isolate each tenant on a dedicated server process.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-115419 with an 8.6 CVSS score, the Agent-to-Agent HTTP server component failed to isolate runtime conversation state across differing context identifiers.
- Exploitation path: Remote authenticated callers in multi-tenant environments query alternate context identifiers to inspect private dialog history or inject instructions that alter model behavior for subsequent users.
- Remediation releases: Maintainers resolved the state leakage in Python package strands-agents version 1.43.0 and TypeScript library @strands-agents/sdk version 1.5.0.