strands-agents/sdk vulnerabilities

CVEs whose affected-version data names the strands-agents/sdk package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-115419High· 8.1

yesterday

Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could rea…

▾ TwilightAWS · strands-agentsvia CVEORG