CVE-2026-115419

Published 22 October 2026 · tracked since 23 October 2026

Description

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instru

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-54630 CRITICAL 9.6
• CVE-2026-54631 MEDIUM 6.3
• CVE-2026-19678
• CVE-2026-115536 MEDIUM 4.3
• CVE-2026-115537 MEDIUM 4.3
• CVE-2026-115535 LOW 2.4
• CVE-2026-115534 MEDIUM 4.3
• CVE-2026-114625
• CVE-2026-83938 CRITICAL 10
• CVE-2026-114620 MEDIUM 5.4

→ Open the live CVE board · all tools