early signals AWS security bulletins

CVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

// summary

CVE-2026-115419 is an issue in the Strands Agents SDK A2A server where conversation state was not isolated between authenticated callers, allowing data to be disclosed to the wrong session.

// from the source

Bulletin ID: 2026-146-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:00 PM PDT Description: Strands Agents is an open-source SDK, available for Python and TypeScript, for building AI agents. The SDK includes an Agent2Agent (A2A) server component that exposes an agent over HTTP so other agents and clients can call it. We identified CVE-2026-115419, an issue where the A2A server did not properly isolate conversation state between callers. An authenticat
Read at aws.amazon.com ↗ More from AWS security bulletins

# more from AWS security bulletins

  1. AWS security bulletins

    CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server

    aws.amazon.com
  2. AWS security bulletins

    CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server

    aws.amazon.com
  3. AWS security bulletins infra

    CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

    aws.amazon.com
  4. AWS security bulletins

    CVE-2026-87911

    aws.amazon.com
  5. AWS security bulletins infra

    CVE-2026-85788 - Issue with awslabs mysql-mcp-server

    aws.amazon.com