strands-agents has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 7.6 (high).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.6
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
3
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-115419High· 8.1Strands Agents SDK: Exposure of data element to wrong session in the A2A Server45GHSA-3w55-933p-8pv5High· 7.1Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage39GHSA-763v-5pjm-fx36MediumStrands Agents: Default FileSessionManager storage is world-readable on shared systems28
strands-agents vulnerabilities
CVEs affecting strands-agents, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
GHSA-763v-5pjm-fx36MediumStrands Agents: Default FileSessionManager storage is world-readable on shared systems
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
▾ Sunlitstrands-agents · strands-agentsvia OSV
GHSA-3w55-933p-8pv5High· 7.1Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
▾ Twilightstrands-agents · strands-agentsvia OSV
CVE-2026-115419High· 8.1Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
▾ Twilightstrands-agents · strands-agentsEPSS 0.43%via OSV