Strands Agents SDK: Exposure of data element to wrong session in the A2A Server

Description

Summary
Strands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents/sdk), for building and running AI agents.

Recommendation

Update the @strands-agents/sdk package to the latest compatible version. Followings are version details:

Affected version(s): < 1.5.0
Patched version(s): 1.5.0

References

GHSA-4v6f-7vjh-6x4m
aws.amazon.com
pypi.org
www.npmjs.com
CVE-2026-115419
CWE-488
CAPEC-310

Could your website be exposed too?

SmartScanner can check your website for Strands Agents SDK: Exposure of data element to wrong session in the A2A Server and gives you actionable findings to investigate.

Start a free scan

Related Issues

Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing - CVE-2026-1664
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection - CVE-2026-25528
Element Call reports full URLs of visited pages to analytics server - CVE-2026-48007
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - CVE-2026-49993

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated October 23, 2026