---
title: Agent infrastructure bugs at AWS: a sandbox escape in the managed AWS MCP Server's run_script tool and cross-tenant leaks in Strands Agents' A2A server | ctxsec
url: https://ctxsec.com/items/aws-mcp-run-script-sandbox-strands-a2a-isolation
description: ""
status: "confirmed (AWS security bulletins 2026-146 and 2026-149, Oct 22-23); no exploitation reported"
published: 2026-10-23
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/aws-mcp-run-script-sandbox-strands-a2a-isolation.md)

confirmed (AWS security bulletins 2026-146 and 2026-149, Oct 22-23); no exploitation reported

2026-10-23

### Agent infrastructure bugs at AWS: a sandbox escape in the managed AWS MCP Server's run_script tool and cross-tenant leaks in Strands Agents' A2A server

- **CVE-2026-115845, AWS MCP Server (Oct 23):** the Python validator behind the `run_script` tool, which runs agent-written scripts with the caller's IAM permissions, had an incomplete blocklist, so a crafted script could run arbitrary code inside the user's own isolated session. AWS fixed it service-side; no customer action is needed.
- **CVE-2026-115419, Strands Agents A2A server (Oct 22):** the Agent2Agent server component did not isolate conversation state between callers, so one authenticated user could read another caller's history or steer the model for them in multi-tenant setups. Fixed in `strands-agents` 1.43.0 (Python) and `@strands-agents/sdk` 1.5.0 (TypeScript). There is no workaround except running one A2A server per user or tenant.

Why it matters: blocklist validators for agent-run code keep failing, and A2A endpoints are a new shared-state surface. If you expose an agent over A2A to more than one user, check that sessions are keyed per caller, not per server.

Sources: [AWS Security Bulletin 2026-149-AWS: CVE-2026-115845 (Oct 23)](https://aws.amazon.com/security/security-bulletins/2026-149-aws/) · [AWS Security Bulletin 2026-146-AWS: CVE-2026-115419 (Oct 22)](https://aws.amazon.com/security/security-bulletins/2026-146-aws/) · [GHSA-4v6f-7vjh-6x4m](https://github.com/advisories/GHSA-4v6f-7vjh-6x4m)