AWS fixes an agent SDK flaw that mixed up callers' conversations

AWS fixes an agent SDK flaw that mixed up callers' conversations

22 October 2026: AWS has fixed CVE-2026-115419 in the Agent2Agent (A2A) server of its open-source Strands Agents SDK, which did not keep conversation state separate between callers, so an authenticated user of a shared agent could read another caller's conversation history or steer the model's behaviour for other callers. It is one of four bulletins AWS published on 22 October, all rated Important; the others cover command injection in the SAM CLI, cross-account metadata exposure in Amazon Athena and a denial-of-service bug in the aws-c-mqtt library.

Not yet independently verified. AWS rates all four bulletins Important without publishing CVSS scores, and it does not say whether any of the issues was exploited. We will update this when it can be confirmed, and remove this note.

Fixed versions

Component	CVE	Fixed in	Action
Strands Agents SDK, A2A server (Python)	CVE-2026-115419	strands-agents 1.43.0	upgrade
Strands Agents SDK (TypeScript)	CVE-2026-115419	@strands-agents/sdk 1.5.0	upgrade
AWS SAM CLI, Terraform hook	CVE-2026-115414	1.166.2 (affected from 1.63.0)	upgrade
Amazon Athena engine version 3	CVE-2026-115416	fixed by AWS on 7 October	none
aws-c-mqtt (AWS Common Runtime, IoT Device SDK for C++ v2)	CVE-2026-115417	0.16.2 (affected from 0.9.1)	upgrade

One agent server, many callers

The A2A component exposes an agent over HTTP so other agents and clients can call it. In the affected versions all callers effectively shared conversation state, which matters most where one agent serves several users or tenants: one customer's prompts, retrieved documents and answers could surface in another's session. The fixed releases isolate state per A2A context_id. AWS says no workaround fully fixes older versions; until teams upgrade, an A2A server should not be exposed to more than one user or tenant, or each user or tenant should get its own server instance. AWS also asks anyone running forked or derivative code to carry the fix across.

This is the class of flaw that multi-agent protocols make easy to miss: the agent behaves correctly in testing with a single caller, and the leak only appears under concurrent use.

Build hosts, query metadata and IoT clients

The SAM CLI flaw affects sam build --hook-name terraform. The hook writes a Makefile recipe that inserts a Terraform resource address without fully neutralising shell metacharacters, so someone able to influence the Terraform configuration or plan file a build consumes can run commands as the build user. That puts CI runners at risk where third-party modules or shared repositories feed the build; AWS's interim advice is to build only from trusted configuration and to audit outside modules. Shubham Raj of Cipher by Causal Security reported it.

In Athena engine version 3, incorrect authorisation checks could have let an authenticated user read other AWS accounts' identifiers and the text of their SQL statements. AWS says query results and data in Amazon S3 or other sources were not reachable, and it fixed the issue on 7 October with no customer action needed. Query text often contains table names, customer identifiers or literal values, so teams that put sensitive values into SQL may want to review what their queries carried before that date.

The aws-c-mqtt bug is an oversized memory allocation in the library's MQTT 3.1.1 compatibility adapter that lets a remote party crash the client process. Until devices are updated, AWS advises connecting only to trusted brokers such as AWS IoT Core over TLS, and preferring a native MQTT5 or MQTT 3.1.1 client to the adapter. Eunho Kim reported it.

Related on TrustList:

• LiteLLM 1.107.0 shipped a credential stealer on PyPI and Docker
• SAP patches a CVSS 10 token flaw in its Cloud SDK for Python
• QPACK flaws let one connection exhaust memory on HTTP/3 servers

Sources

• AWS security bulletin 2026-146-AWS: CVE-2026-115419, Strands Agents SDK A2A server, 22 October 2026
• AWS security bulletin 2026-145-AWS: CVE-2026-115414, SAM CLI Terraform hook, 22 October 2026
• AWS security bulletin 2026-144-AWS: CVE-2026-115416, Amazon Athena engine version 3, 22 October 2026
• AWS security bulletin 2026-147-AWS: CVE-2026-115417, aws-c-mqtt, 22 October 2026