---
id: "GHSA-763v-5pjm-fx36"
kind: "vulnerability"
aliases: ["GHSA-763v-5pjm-fx36"]
title: "Strands Agents: Default FileSessionManager storage is world-readable on shared systems"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "strands-agents", "fixed": ["1.48.0"], "affected": "< 1.48.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "ci", "cwe-276", "notebooks", "python", "shared-hosts", "strands-agents"]
not_affected_if: ["explicit-storage-dir", "restrictive-umask", "single-user-host"]
published_at: "2026-10-27T15:34:28+00:00"
first_seen_at: "2026-10-27T15:39:16+00:00"
updated_at: "2026-10-27T15:39:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-763v-5pjm-fx36", "first_seen_at": "2026-10-27T15:39:16+00:00"}]
---

# Strands Agents: Default FileSessionManager storage is world-readable on shared systems

The Strands Agents FileSessionManager writes persisted agent sessions to /tmp/strands/sessions using the process umask, so with the common umask 022 the JSON files are world-readable. Other local users on the same machine can read prompts, model output, tool inputs and outputs, and any secrets that pass through the agent.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:strands-agents affected < 1.48.0 fixed 1.48.0

## How to check

- Run `python -c "import tempfile,os; print(os.path.join(tempfile.gettempdir(),'strands/sessions'))"` and then `ls -ld /tmp/strands/sessions` to see whether the default directory exists and its mode
- Check `ls -l /tmp/strands/sessions/*/session.json` for files with mode `-rw-r--r--`
- Check the installed version with `pip show strands-agents` and compare against `1.48.0`

## Fix

- Upgrade `strands-agents` to `1.48.0` or later
- Set `storage_dir` on FileSessionManager to a private directory you own when using a shared host
- Delete existing session data under `/tmp/strands/sessions` after upgrading if it may contain secrets, and rotate any secrets that appeared in sessions

## Timeline

- 2026-10-27T15:39:16+00:00 ghsa https://github.com/advisories/GHSA-763v-5pjm-fx36

## From the sources

There is a local confidentiality issue in the default `FileSessionManager` storage behavior. By default it writes session data under `/tmp/strands/sessions` and relies on the process umask for directory and file permissions. On systems using the common `umask 022`, the session directories are `0755` and JSON files are `0644`, so other local users can read persisted agent session data.

This matters on shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers. Session storage is intended to persist conversation/history/state, so it can contain prompts, model output, tool inputs/outputs, intermediate state, and secrets that pass through the agent.

Relevant code:
- `strands-py/src/strands/session/file_session_manager.py:58`: default storage path is `os.path.join(tempfile.gettempdir(), "strands/sessions")`.
- `strands-py/src/strands/session/file_session_manager.py:118`: creates parent directories without a private mode.
- `strands-py/src/strands/session/file_session_manager.py:121`: writes JSON files via normal `open(..., "w")`.
- `strands-py/src/strands/session/file_session_manager.py:131`: creates session directories without a private mode.

Local reproduction with `umask 022`:

```text
default_storage_dir= /tmp/strands/sessions
0o755 /tmp/strands/sessions
0o755 /tmp/strands/sessions/session_codex_perm_poc
0o644 /tmp/strands/sessions/session_codex_perm_poc/session.json
file_contains_secret= True
```

The fixture wrote a fake secret into the session dict to show that sensitive session fields are readable through the resulting file.

Suggested fixes:
- Use a private per-user data directory by default rather than `/tmp`, or create `/tmp/strands` and descendants with `0700`.
- Write session JSON atomically with `0600` permissions.
- Consider refusing to use an existing default storage directory if it is not owned by the current user or is group/world accessible.
- Document that callers should set `storage_dir` explicitly when they need shared storage.

This was reproduced on commit `dd7b41de38cb`.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_