AWS Strands Agents Tools Received Four CVEs in 23 Days — And They All Share the Same Root Cause

AWS Strands Agents Tools, the first-party tool package for the Strands Agents SDK, received four CVEs between July 15 and August 6, 2026, all stemming from security-sensitive parameters exposed as LLM-controllable inputs. The vulnerabilities include credential disclosure (CVE-2026-15746, CVSS 6.5), proxy bypass (CVE-2026-18394, CVSS 6.9), arbitrary command execution (CVE-2026-18733, CVSS 8.8), and tenant isolation bypass (CVE-2026-19111, CVSS 8.1). AWS fixed them by binding security-critical parameters at construction time and removing them from the LLM-controllable schema.

Between July 15 and August 6, 2026, AWS Strands Agents Tools https://github.com/strands-agents/tools — the first-party tool package for the Strands Agents SDK — received four distinct security advisories. The vulnerabilities range from credential disclosure to arbitrary command execution, but they share a singular root cause: security-sensitive parameters were exposed as LLM-controllable inputs in the tool schema. This is not a series of isolated bugs. It is a design pattern failure — one that recurs across memory tools, shell execution, HTTP routing, and credential management within the same package. Four CVEs, One Root Cause The earliest advisory, CVE-2026-15746 https://github.com/strands-agents/tools/security/advisories/GHSA-ppcf-fpr3-x46v CVSS 6.5, July 15 , disclosed credential exfiltration in the elasticsearch memory tool. The tool exposed its connection parameters — es url , cloud id , api key — as fields the LLM could control. When the api key parameter was omitted, the tool fell back to the operator’s environment variable. A crafted prompt could redirect the tool to an attacker-controlled server, sending the operator’s Elasticsearch API key in the Authorization header. Two weeks later, CVE-2026-18394 https://github.com/strands-agents/tools/security/advisories/GHSA-qhw6-2h72-m84v CVSS 6.9, July 31 exposed a similar flaw in the http request tool. The tool used HTTP REQUEST TOKEN CONFIG to bind credentials to an allowlist of hostnames — but it also exposed a proxies parameter that was LLM-controllable. A prompt injection could set the proxy to an attacker’s endpoint. The allowlist check passed on the request URL, the Authorization header was injected, and the request was routed through the attacker’s proxy on the first hop. GET requests additionally bypassed the tool’s consent gate. The most severe, CVE-2026-18733 https://github.com/strands-agents/tools/security/advisories/GHSA-mqvc-p852-wf8x CVSS 8.8, August 3 , involved the shell tool’s consent gate. The tool exposed a non interactive parameter in the LLM-controllable schema. Indirect prompt injection — via a web page, Slack message, or file the agent reads — could set non interactive to true, skipping the consent gate entirely. The result was arbitrary OS command execution on the host with the agent process’s privileges. AWS classified this under CWE-1427 https://cwe.mitre.org/data/definitions/1427.html Improper Neutralization of Input Used for LLM Prompting , a weakness category specific to LLM-integrated systems. Three days later, CVE-2026-19111 https://github.com/strands-agents/tools/security/advisories/GHSA-mpxq-953j-42m4 CVSS 8.1, August 6 may be the most architecturally telling. The mongodb memory , elasticsearch memory , and mem0 memory tools each used a namespace field as the sole tenant-isolation key for every record, list, retrieve, and delete operation. That namespace was exposed as an LLM-controllable parameter. The tools validated the namespace syntactically but did not verify that the caller was authorized to use it. A remote authenticated user could craft a prompt to forge a namespace — reading, modifying, or deleting another tenant’s memories, or injecting false memories to poison future agent context. The standalone MongoDB and Elasticsearch tools additionally exposed connection parameters, allowing the LLM to redirect the memory backend to an attacker-specified cluster. The Fix Pattern Across all four advisories, the remediation followed the same structure: bind security-critical parameters when the tool is constructed, and remove them from the LLM-controllable schema entirely. In the fixed versions, the namespace is no longer a tool parameter. The non interactive flag no longer bypasses the consent gate. The proxy configuration is set through environment variables, not through the tool. The connection parameters are pinned at initialization. This is not a novel insight in traditional software security — input validation and privilege separation are foundational. But agent-native tooling introduces a new category of risk: parameters that were never designed to be user-facing become user-controllable because the LLM mediates every interaction. The tool schema is the API, and the LLM is the caller. What This Signals The CSA Agent Identity Governance Framework https://labs.cloudsecurityalliance.org/agentic/agentic-identity-governance-framework-v1/ recommends Just-In-Time access and cryptographic workload attestation for agent identities. The FusionAuth 2026 AI Identity Report https://fusionauth.io/blog/2026-ai-identity-report found that 66% of organizations have experienced an AI identity breach, with only 28% able to trace agent actions back to a human sponsor. The gap between governance frameworks and implementation reality is wide. Strands Agents Tools is not a niche third-party library. It is AWS’s own tooling for its agent SDK, maintained at 1.2k GitHub stars and 327 forks. Four advisories in 23 days — two rated HIGH — in a first-party package signal that the agent-native stack is still working through security fundamentals that traditional infrastructure resolved decades ago. The sequence extends the pattern documented across the MCP supply chain wave /the-package-registry-layer-how-supply-chain-attacks-are-targeting-agent-infrastructure/ , the CoreBreak dispatch-layer bypass /cve-2026-40369-exploit-code-drops-three-months-after-patch-and-ai-agents-inherit-the-sandbox-escape/ , and the ChatMate remote prompt execution class. The attack surface is not the model. It is the plumbing the model controls.