October advisories hit Strands A2A sessions, LangGraph store namespaces, FastMCP auth and MLflow scorers

Four frameworks, five advisories, one bad habit: multi-caller agent servers that trusted a shared object, a joined string, or a transform pipeline to enforce isolation.

Corgea's 25 October digest is the clean primary for reading them together. The upgrades matter; the caller-code migrations matter more.

Shared A2A agents, dot-joined stores, skipped AuthChecks and scorer SSRF

CVE-2026-115419 hits Amazon's Strands Agents SDK on PyPI (strands-agents < 1.43.0) and npm (@strands-agents/sdk < 1.5.0). A2AServer accepted a single Agent instance and reused its in-memory messages, prompt state and stream fields across every Agent2Agent context_id. Any caller could read another session's history or plant persistent instructions for the next tenant. The fix adds agent_factory / agentFactory so each context gets its own agent and lock; passing a lone agent= remains deprecated with serialised snapshot swapping.

CVE-2026-115883 hits LangGraph's PostgresStore and SqliteStore. Namespaces such as ("tenant", "bob") were serialised as tenant.bob. BaseStore rejected dots on put, yet get, search, delete, list_namespaces and batch skipped that check, so a label tenant.bob could read or overwrite ("tenant", "bob"). Patches land in langgraph-checkpoint-postgres 3.1.3, sqlite 3.1.2 and langgraph-checkpoint 4.3.0.

FastMCP's GHSA-7xgj-8392-5q4r covers AuthChecks that ran on list paths after transforms but were skipped on direct call_tool / resource lookups against pre-transform components. GHSA-vqqp-x5qm-5qp4 covers ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider wrappers that never forwarded issuer=, letting a malicious MCP server advertise its own token endpoint and capture client secrets. Fixed lines are fastmcp 3.4.10 and 4.1.2, with an explicit issuer still required in caller code.

CVE-2026-115886 hits MLflow tracking servers (>= 3.12.0rc0, < 3.17.0) when TruLens LiteLLM scorers are installed. Unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke deserialised third_party_scorer_data into scorer classes and forwarded attacker-controlled api_base / headers into LiteLLM, yielding SSRF. Fixed in 3.17.0.

Agent frameworks became the new shared hosting edge

These bugs are boring in the best security sense: session confusion, path traversal by delimiter, authZ TOCTOU after a transform, classic SSRF. They bite now because Strands A2A, LangGraph stores, FastMCP and MLflow scorers are the defaults teams copy into multi-tenant demos. The same October window closed eight MCP reference-server advisories. Reading them as four unrelated tickets misses the pattern: agent-framework surface defaults are carrying yesterday's single-user assumptions into multi-caller deployments.

Open packages; maturity is upgrade-plus-migrate

All four projects ship as public open-source packages with ordinary advisory channels (GHSA/CVE). Activity clustered on 22–23 October 2026, with Corgea's write-up dated 25 October. Maturity for this news: treat any multi-caller A2A Strands server below 1.43.0 / 1.5.0, any LangGraph store below the patched checkpoint lines, any FastMCP 3.x/4.x in the affected bands, and any MLflow 3.12–3.16 tracking host with TruLens scorers as overdue. Demo notebooks that never expose A2A or tracking ports are a narrower exposure; shared staging clusters are not.

Patch versions, then change the two call sites that still leak

Start with Strands: upgrade the packages and rewrite A2AServer(agent=...) to agent_factory. For LangGraph, upgrade the checkpoint packages and audit any code that builds namespace tuples from user strings; custom stores that still join with . should call the new validators. On FastMCP, upgrade and pass issuer="https://..." into M2M OAuth providers, then rotate secrets that ever touched untrusted MCP URLs. For MLflow, move to 3.17.0 and keep scorer invoke off unauthenticated networks.

If you only run single-user local agents with no A2A, no shared store namespaces, no transform-tagged admin tools and no TruLens scorers, take the releases on the normal cadence and still read the Corgea table once.

Version bumps without factory or issuer migrations

Strands 1.43.0 still accepts a shared agent= under deprecation; fleets that only bump the pin keep weak isolation under load. LangGraph apps that sanitize puts but build get namespaces from raw tenant slugs stay exposed until every path validates. FastMCP hosts that upgrade without setting issuer= leave client credentials open to malicious resource metadata. MLflow operators who assume "tracking is internal" while leaving scorer invoke reachable from the same ingress as the UI recreate the SSRF. Treating AuthCheck tags added only by transforms as list-only controls recreates the FastMCP bypass after the next feature flag.

Read the Corgea table as one patch queue

File the four upgrades in a single agent-framework security change window beside the MCP server pins from v2.1.0. The open Monday question is how many A2A and store deployments will claim "patched" while still passing a singleton agent or a user-controlled dotted namespace.