LLM frameworks · AWS (open source)
Strands Agents
Open-source SDK from AWS for building AI agents in Python and TypeScript, including Agent2Agent (A2A) servers.
3Advisories
0critical
2high
1medium
2026-10-28Latest
Timeline · advisories per quarter
32026 Q4
Named in sources
Reported for Strands Agents
01. GHSA-3w55-933p-8pv5: Strands Agents' default session storage in /tmp could be hijacked with symlinks and read by other local usersThe Strands Agents Python SDK's FileSessionManager stored sessions under /tmp/strands/sessions by default, with predictable paths, a write that follows symlinks, and the normal umask. Another user on the same machine could overwrite files the agent process can write, plant session history that the agent reloads as a lasting prompt injection, or simply read saved conversations and secrets. Fixed in strands-agents 1.48.0. Strands Agents 2026-10-27 02. CVE-2026-115419: Strands Agents A2A servers shared conversation history between different callersThe Agent2Agent (A2A) server in AWS's Strands Agents SDK didn't isolate conversation state between callers with different context_id values. In a deployment used by more than one user or tenant, an authenticated caller could read another caller's conversation history or steer the model's answers to them. Fixed in strands-agents 1.43.0 (Python) and @strands-agents/sdk 1.5.0 (TypeScript). Strands Agents 2026-10-23 03. CVE-2026-115415: A prompt can make the Strands Agents Tools environment tool return every environment variable unmasked, including cloud keysThe environment tool in strands-agents-tools masks secret-looking environment variables by default, but the masked switch was part of the tool's input schema, so the model could turn it off, and the list and get actions ran without operator consent. Instructions hidden in a web page, file or earlier tool output could make the agent list every variable unmasked, AWS keys and model API keys included, and pass them on through another tool. Fixed in 0.8.6, which also deprecates the tool. Strands Agents 2026-10-28
Strands Agents 2026-10-27 02. CVE-2026-115419: Strands Agents A2A servers shared conversation history between different callersThe Agent2Agent (A2A) server in AWS's Strands Agents SDK didn't isolate conversation state between callers with different context_id values. In a deployment used by more than one user or tenant, an authenticated caller could read another caller's conversation history or steer the model's answers to them. Fixed in strands-agents 1.43.0 (Python) and @strands-agents/sdk 1.5.0 (TypeScript). Strands Agents 2026-10-23 03. CVE-2026-115415: A prompt can make the Strands Agents Tools environment tool return every environment variable unmasked, including cloud keysThe environment tool in strands-agents-tools masks secret-looking environment variables by default, but the masked switch was part of the tool's input schema, so the model could turn it off, and the list and get actions ran without operator consent. Instructions hidden in a web page, file or earlier tool output could make the agent list every variable unmasked, AWS keys and model API keys included, and pass them on through another tool. Fixed in 0.8.6, which also deprecates the tool. Strands Agents 2026-10-28