AWS Strands Agents SDK Updates Isolate A2A Conversation State
Tech GuruQuick Answer
AWS bulletin 2026-146-AWS fixes CVE-2026-115419 in the Strands Agents SDK A2A Server. Upgrade Python to 1.43.0 and TypeScript to 1.5.0 or later, validate tenant isolation, and retain package and test evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory A2A servers, Python and TypeScript SDK versions, multiagent.a2a use, tenant models, conversation data, forks, deployments, and owners. Determine whether an affected server handled more than one user or tenant; do not infer cross-tenant exposure from Strands use outside the A2A server path. Upgrade to the fixed SDK release and patch forks. Until then, operate a separate A2A server instance for each user or tenant because AWS says no workaround fully addresses the flaw. Confirm deployed package versions, test context separation with representative tenants, review relevant access and conversation logs where exposure was possible, and retain evidence.
Last verified: 2026-10-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Strands Agents SDK A2A Server for Python and TypeScript |
|---|---|
| Advisory | 2026-146-AWS |
| CVE | CVE-2026-115419 |
| Authoritative release date | 2026-10-22 20:07:11 UTC |
| Authority revision date | 2026-10-22 20:07:11 UTC |
| Affected versions | Python strands-agents releases containing multiagent.a2a before 1.43.0 and TypeScript @strands-agents/sdk before 1.5.0 when one A2A server handles multiple users or tenants. |
| Fixed version | strands-agents 1.43.0 and @strands-agents/sdk 1.5.0 or later |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | AWS does not state that this issue is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
AWS corrected conversation-state isolation by binding state to each A2A context_id. A multi-tenant affected server could disclose one caller's conversation data to another.
What To Validate Now
- Inventory. Inventory A2A servers, Python and TypeScript SDK versions, multiagent.a2a use, tenant models, conversation data, forks, deployments, and owners.
- Establish applicability. Determine whether an affected server handled more than one user or tenant; do not infer cross-tenant exposure from Strands use outside the A2A server path.
- Remediate. Upgrade to the fixed SDK release and patch forks. Until then, operate a separate A2A server instance for each user or tenant because AWS says no workaround fully addresses the flaw.
- Validate. Confirm deployed package versions, test context separation with representative tenants, review relevant access and conversation logs where exposure was possible, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Process or container separation must actually enforce one user or tenant per affected server. A routing convention or caller-supplied context identifier is not equivalent to the fixed state isolation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
