# Strands A2A: keep each user’s conversations separate

Canonical: https://www.oktsec.com/radar/strands-agents-a2a-cve-2026-115419
Publisher: Oktsec
Language: en
Published: 2026-10-25T13:12:31Z
Updated: 2026-10-25T13:12:31Z
Record reviewed: 2026-10-25T13:12:31Z
Latest evidence check: 2026-10-25T13:12:31Z
Disclosed: 2026-10-22

An authenticated user may read or influence another user’s conversations on an affected shared A2A server. Update the Strands SDK and verify session isolation.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Review this week
- Rationale: Vendor-confirmed session isolation failure with fixes available. Prioritize affected shared deployments; exploitation in the wild is not established by the reviewed advisories.
- Evidence: Exploitation not established
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Account access required
- Vendor: Strands Agents
- Products: Strands Agents SDK for Python, Strands Agents SDK for TypeScript
- CVEs: CVE-2026-115419
- Vendor severity: CVSS 3.1 8.1

## Technical overview

The affected A2A server can share conversation state across callers. The advisory provides no complete workaround: restrict each server to one user or tenant until updated. The fix isolates state by context_id.

The reviewed advisories do not establish exploitation in the wild. This record covers the SDK’s A2A server, not every application built with Strands.

## Recommended response

Update the Strands SDK: Python 1.43.0 or TypeScript 1.5.0. Isolate users until patched.

Relevant to: Teams sharing a Strands A2A server across users or tenants.

## CVE attribution

- CVE-2026-115419: Strands Agents — Strands Agents SDK for Python, Strands Agents SDK for TypeScript; CVSS 3.1: 8.1. [Source](https://github.com/strands-agents/harness-sdk/security/advisories/GHSA-4v6f-7vjh-6x4m)

## Affected systems and fixes

### strands-agents (Python)

Affected: Versions containing multiagent.a2a before 1.43.0

Fixed release / action: 1.43.0

### @strands-agents/sdk (TypeScript)

Affected: Before 1.5.0

Fixed release / action: 1.5.0

Confirm the running version against the vendor advisory, including any distribution backports.

## CISA KEV evidence

Catalog: 2026.10.23
Checked: 2026-10-25T13:14:04.591Z

No matching CVE appears in the reviewed catalog snapshot.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-10-25T13:14:05.068Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast

- [CVE-2026-115419](https://api.first.org/data/v1/epss?cve=CVE-2026-115419): 0.34% probability of observed exploitation in the next 30 days; percentile 26.24%; score date 2026-10-24.

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-25T13:14:05.068Z.

## Response checklist

1. **Identify shared A2A servers** — Check SDK versions and whether different users or tenants reach the same server.
2. **Update both deployments and forks** — Install the fixed SDK and incorporate the fix in derivative code. Until updated, use a separate server instance per user or tenant.
3. **Verify boundaries before reopening access** — Oktsec recommends testing with synthetic accounts and conversations to confirm that one user cannot read or influence another’s session.

## Relevance to AI environments

Oktsec recommends verifying conversation boundaries alongside gateway permissions; transport access controls alone do not demonstrate session isolation.

## Sources

- [Strands A2A session isolation advisory](https://github.com/strands-agents/harness-sdk/security/advisories/GHSA-4v6f-7vjh-6x4m) — Strands Agents; Vendor notice; checked 2026-10-25T13:12:31Z
- [AWS security bulletin 2026-146](https://aws.amazon.com/security/security-bulletins/2026-146-aws/) — AWS; Vendor notice; checked 2026-10-25T13:12:31Z

## Editorial record

- 2026-10-25T13:12:31Z: Added coverage of the October 22 advisory. Radar publication is not a new disclosure or evidence of a new attack.

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.