GHSA-4v6f-7vjh-6x4mPublished

Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

cve-program · CVE-2026-115419

Published

strands-agents

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "AWS",
                    "product": "strands-agents",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "1.43.0",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

strands-agents/sdk

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "AWS",
                    "product": "strands-agents/sdk",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "1.5.0",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

nvd · CVE-2026-115419

Published

No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.

osv · GHSA-4v6f-7vjh-6x4m

Published

strands-agents

PyPI

ECOSYSTEM · introduced 0 → fixed 1.43.0

61 explicitly affected versions

0.0.1, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1, 0.3.0, 1.0.0, 1.0.1, 1.1.0, 1.10.0, 1.11.0, 1.12.0, 1.13.0, 1.14.0, 1.15.0, 1.16.0, 1.17.0, 1.18.0, 1.19.0, 1.2.0, 1.20.0, 1.21.0, 1.22.0, 1.23.0, 1.24.0, 1.25.0, 1.26.0, 1.27.0, 1.28.0, 1.29.0, 1.3.0, 1.30.0, 1.31.0, 1.32.0, 1.33.0, 1.34.0, 1.34.1, 1.35.0, 1.36.0, 1.37.0, 1.38.0, 1.39.0, 1.4.0, 1.40.0, 1.41.0, 1.42.0, 1.5.0, 1.6.0, 1.7.0, 1.7.1, 1.8.0, 1.9.0, 1.9.1

@strands-agents/sdk

npm

SEMVER · introduced 0 → fixed 1.5.0