Skip to content
OpenAdvisories

Product · AWS

strands-agents-tools

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-19111

    Insecure direct object reference in Strands Agents Tools memory tool namespace isolation

    Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influenc…

    AWS strands-agents-tools
  • High 8.8
    CVE-2026-18733

    Prompt injection bypasses shell tool consent gate in Strands Agents Tools

    A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, b…

    AWS strands-agents-tools
  • High 7.4
    CVE-2026-18394

    Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

    Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastru…

    AWS strands-agents-tools