{"slug": "aws-strands-agents-tools-received-four-cves-in-23-days-and-they-all-share-the", "title": "AWS Strands Agents Tools Received Four CVEs in 23 Days — And They All Share the Same Root Cause", "summary": "AWS Strands Agents Tools, the first-party tool package for the Strands Agents SDK, received four CVEs between July 15 and August 6, 2026, all stemming from security-sensitive parameters exposed as LLM-controllable inputs. The vulnerabilities include credential disclosure (CVE-2026-15746, CVSS 6.5), proxy bypass (CVE-2026-18394, CVSS 6.9), arbitrary command execution (CVE-2026-18733, CVSS 8.8), and tenant isolation bypass (CVE-2026-19111, CVSS 8.1). AWS fixed them by binding security-critical parameters at construction time and removing them from the LLM-controllable schema.", "body_md": "Between July 15 and August 6, 2026, [AWS Strands Agents Tools](https://github.com/strands-agents/tools) — the first-party tool package for the Strands Agents SDK — received four distinct security advisories. The vulnerabilities range from credential disclosure to arbitrary command execution, but they share a singular root cause: security-sensitive parameters were exposed as LLM-controllable inputs in the tool schema.\n\nThis is not a series of isolated bugs. It is a design pattern failure — one that recurs across memory tools, shell execution, HTTP routing, and credential management within the same package.\n\n## Four CVEs, One Root Cause\n\nThe earliest advisory, [CVE-2026-15746](https://github.com/strands-agents/tools/security/advisories/GHSA-ppcf-fpr3-x46v) (CVSS 6.5, July 15), disclosed credential exfiltration in the `elasticsearch_memory`\n\ntool. The tool exposed its connection parameters — `es_url`\n\n, `cloud_id`\n\n, `api_key`\n\n— as fields the LLM could control. When the `api_key`\n\nparameter was omitted, the tool fell back to the operator’s environment variable. A crafted prompt could redirect the tool to an attacker-controlled server, sending the operator’s Elasticsearch API key in the Authorization header.\n\nTwo weeks later, [CVE-2026-18394](https://github.com/strands-agents/tools/security/advisories/GHSA-qhw6-2h72-m84v) (CVSS 6.9, July 31) exposed a similar flaw in the `http_request`\n\ntool. The tool used `HTTP_REQUEST_TOKEN_CONFIG`\n\nto bind credentials to an allowlist of hostnames — but it also exposed a `proxies`\n\nparameter that was LLM-controllable. A prompt injection could set the proxy to an attacker’s endpoint. The allowlist check passed on the request URL, the Authorization header was injected, and the request was routed through the attacker’s proxy on the first hop. GET requests additionally bypassed the tool’s consent gate.\n\nThe most severe, [CVE-2026-18733](https://github.com/strands-agents/tools/security/advisories/GHSA-mqvc-p852-wf8x) (CVSS 8.8, August 3), involved the shell tool’s consent gate. The tool exposed a `non_interactive`\n\nparameter in the LLM-controllable schema. Indirect prompt injection — via a web page, Slack message, or file the agent reads — could set `non_interactive`\n\nto true, skipping the consent gate entirely. The result was arbitrary OS command execution on the host with the agent process’s privileges. AWS classified this under [CWE-1427](https://cwe.mitre.org/data/definitions/1427.html) (Improper Neutralization of Input Used for LLM Prompting), a weakness category specific to LLM-integrated systems.\n\nThree days later, [CVE-2026-19111](https://github.com/strands-agents/tools/security/advisories/GHSA-mpxq-953j-42m4) (CVSS 8.1, August 6) may be the most architecturally telling. The `mongodb_memory`\n\n, `elasticsearch_memory`\n\n, and `mem0_memory`\n\ntools each used a namespace field as the sole tenant-isolation key for every record, list, retrieve, and delete operation. That namespace was exposed as an LLM-controllable parameter. The tools validated the namespace syntactically but did not verify that the caller was authorized to use it. A remote authenticated user could craft a prompt to forge a namespace — reading, modifying, or deleting another tenant’s memories, or injecting false memories to poison future agent context. The standalone MongoDB and Elasticsearch tools additionally exposed connection parameters, allowing the LLM to redirect the memory backend to an attacker-specified cluster.\n\n## The Fix Pattern\n\nAcross all four advisories, the remediation followed the same structure: bind security-critical parameters when the tool is constructed, and remove them from the LLM-controllable schema entirely. In the fixed versions, the namespace is no longer a tool parameter. The `non_interactive`\n\nflag no longer bypasses the consent gate. The proxy configuration is set through environment variables, not through the tool. The connection parameters are pinned at initialization.\n\nThis is not a novel insight in traditional software security — input validation and privilege separation are foundational. But agent-native tooling introduces a new category of risk: parameters that were never designed to be user-facing become user-controllable because the LLM mediates every interaction. The tool schema is the API, and the LLM is the caller.\n\n## What This Signals\n\nThe [CSA Agent Identity Governance Framework](https://labs.cloudsecurityalliance.org/agentic/agentic-identity-governance-framework-v1/) recommends Just-In-Time access and cryptographic workload attestation for agent identities. The [FusionAuth 2026 AI Identity Report](https://fusionauth.io/blog/2026-ai-identity-report) found that 66% of organizations have experienced an AI identity breach, with only 28% able to trace agent actions back to a human sponsor. The gap between governance frameworks and implementation reality is wide.\n\nStrands Agents Tools is not a niche third-party library. It is AWS’s own tooling for its agent SDK, maintained at 1.2k GitHub stars and 327 forks. Four advisories in 23 days — two rated HIGH — in a first-party package signal that the agent-native stack is still working through security fundamentals that traditional infrastructure resolved decades ago.\n\nThe sequence extends the pattern documented across the [MCP supply chain wave](/the-package-registry-layer-how-supply-chain-attacks-are-targeting-agent-infrastructure/), the [CoreBreak dispatch-layer bypass](/cve-2026-40369-exploit-code-drops-three-months-after-patch-and-ai-agents-inherit-the-sandbox-escape/), and the ChatMate remote prompt execution class. The attack surface is not the model. It is the plumbing the model controls.", "url": "https://wpnews.pro/news/aws-strands-agents-tools-received-four-cves-in-23-days-and-they-all-share-the", "canonical_source": "https://forkast.news/aws-strands-agents-tools-received-four-cves-in-23-days-and-they-all-share-the-same-root-cause/", "published_at": "2026-08-22 03:20:36+00:00", "updated_at": "2026-08-22 03:42:28.284765+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy", "ai-ethics"], "entities": ["AWS", "Strands Agents Tools", "Strands Agents SDK", "Elasticsearch", "MongoDB", "mem0"], "alternates": {"html": "https://wpnews.pro/news/aws-strands-agents-tools-received-four-cves-in-23-days-and-they-all-share-the", "markdown": "https://wpnews.pro/news/aws-strands-agents-tools-received-four-cves-in-23-days-and-they-all-share-the.md", "text": "https://wpnews.pro/news/aws-strands-agents-tools-received-four-cves-in-23-days-and-they-all-share-the.txt", "jsonld": "https://wpnews.pro/news/aws-strands-agents-tools-received-four-cves-in-23-days-and-they-all-share-the.jsonld"}}