Strands Agents
Monthly
Cross-tenant conversation-state leakage in the Strands Agents SDK A2A server allows an authenticated remote caller in a multi-tenant deployment to read other tenants' conversation history and plant persistent instructions that alter model behavior for subsequent callers by referencing a different context_id. Python strands-agents before 1.43.0 and TypeScript @strands-agents/sdk before 1.5.0 are affected; single-tenant or single-user deployments are not exposed. No public exploit was identified at time of analysis, and fixes are available in 1.43.0 and 1.5.0.
Cross-tenant conversation-state leakage in the Strands Agents SDK A2A server allows an authenticated remote caller in a multi-tenant deployment to read other tenants' conversation history and plant persistent instructions that alter model behavior for subsequent callers by referencing a different context_id. Python strands-agents before 1.43.0 and TypeScript @strands-agents/sdk before 1.5.0 are affected; single-tenant or single-user deployments are not exposed. No public exploit was identified at time of analysis, and fixes are available in 1.43.0 and 1.5.0.