Strands Agents SDK EUVD-2026-108507

Exploitation requires a multi-tenant deployment in which the Strands Agents A2A server (the multiagent.a2a module) is reachable by more than one user or tenant - single-tenant or single-user deployments are not exposed. The attacker must be an authenticated remote caller (CVSS PR:L) and must send HTTP requests to the A2A endpoint referencing a context_id other than their own; the server's failure to isolate conversation state per context_id then grants cross-tenant read and persistent-instruction write. The only effective limiting factor until patching is deployment topology: the vendor states there is no workaround that fully addresses the issue, and recommends not exposing an A2A server to more than one tenant, or running a separate A2A server instance per user/tenant. Upgrading to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript) is the only complete fix.

Multiple signals converge on a genuine but conditional priority. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) scores 8.6 and the vendor GHSA's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) scores 8.1 - both agree the flaw is network-reachable, low-complexity, and requires only low privileges (an authenticated but ordinary caller, PR:L), with high confidentiality and integrity impact and no availability impact. The vuln.today decision label is 'this_week', consistent with a serious issue that is not an active-exploitation emergency. There is no CISA KEV listing and no EPSS score in the input, and no exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis'. The key limiting factor that tempers the high score: per the vendor advisory, impact only materializes in multi-tenant deployments where the A2A server is reachable by more than one user or tenant - a single-tenant deployment is not exposed. This is a real priority for organizations running the Strands A2A server in a shared/multi-tenant mode, but lower real-world risk for single-user deployments. The input 4.0 score (8.6) and vendor 3.1 score (8.1) differ as expected between frameworks; both reflect the same C:H/I:H/A:N, PR:L profile.

In a multi-tenant deployment of the Strands Agents A2A server, an authenticated user issues HTTP requests to the A2A endpoint using a context_id belonging to another tenant. Because conversation state is not isolated per context_id, the attacker reads the victim tenant's conversation history and injects persistent instructions that alter the model's behavior for that tenant's subsequent requests. No public exploit code is identified, but the technique is straightforward given low attack complexity and only low-privilege authentication.