Agent Frameworks: Strands Agents' A2A Server Shared Conversation History Across Callers (CVE-2026-115419), mem0 Turned Stored Memories Into SQL (CVE-2026-115324), and Agent Zero's Chat Rendered Injected JavaScript (CVE-2026-97635)
CVE-2026-115419 is a high-severity security issue (CVSS 8.1) in mem0ai, a package. Affected: >=0.1.117 <1.0.8 || >=2.0.0 <2.0.18. Fixed in 1.43.0.
Is mem0ai running on your developers' machines? Anomity inventories the AI agents, MCP servers, extensions and skills on every developer device, so you can see what this advisory touches. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-115419- Aliases
- GHSA-5324-3w58-qpp2
- Severity
- high
- CVSS score
- 8.1
- Attack type
- Other
- Component
- Agent Zero · package
- Package
mem0ai- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2026-115419?
The Strands Agents SDK (Python strands-agents before 1.43.0, TypeScript @strands-agents/sdk before 1.5.0) published CVE-2026-115419 on 23 October 2026 (CVSS 8.1): its Agent2Agent (A2A) server did not isolate conversation state between callers with different context_id values, so in a multi-tenant deployment one authenticated caller could read another caller's conversation history and influence the model's behaviour for them. mem0ai 0.1.117 to before 1.0.8 interpolated memory text, metadata and message names into SQL in its Databricks vector store (CVE-2026-115324, published 22 October; GitHub rates it critical, CVSS 8.1), so content that reaches memory could run SQL on the configured Databricks warehouse. Separately, mem0 GHSA-5324-3w58-qpp2 (20 October, medium; the code is in mem0ai 2.0.0 to 2.0.17) joined user_id, agent_id and run_id into a session key with unescaped & and = delimiters, so a caller who controls those values could make their key collide with another user's and fetch that conversation's recent raw messages. Agent Zero's web UI before 1.15 did not sanitize chat messages or uploaded files before rendering them (CVE-2026-97635, CVSS 8.6, published 22 October and listed in CISA advisory VA-26-296-01), so content the agent reproduces runs JavaScript in the user's authenticated session.
Affected versions
| Affected | Fixed in |
|---|---|
>=0.1.117 <1.0.8 || >=2.0.0 <2.0.18 | 1.43.0 |
Am I affected by CVE-2026-115419?
You are affected if you run mem0ai >=0.1.117 <1.0.8 || >=2.0.0 <2.0.18. Versions 1.43.0 and later include the fix.
How do I fix CVE-2026-115419?
Upgrade strands-agents to 1.43.0 or @strands-agents/sdk to 1.5.0, and do not serve several tenants from one A2A server on an older version. Upgrade mem0ai to 2.0.18 or later on PyPI (3.1.6 or later on npm), which covers both mem0 issues, and treat anything an agent can write to memory as untrusted input. Upgrade Agent Zero to 1.15 or later, and do not open untrusted files or paste untrusted content into an older instance's chat.