Authorization Flaw in Strands Agents Tools from Strands
CVE-2026-18394

6.9MEDIUM

Key Information:

Vendor

Aws

Status
Strands Agents Tools
Vendor
CVE Published:
31 July 2026

What is CVE-2026-18394?

An authorization flaw exists in the http_request tool of Strands Agents Tools prior to version 0.8.2. This vulnerability could be exploited by remote attackers who manipulate the Language Model (LLM) to direct requests through an attacker-controlled proxy, potentially exposing sensitive credentials configured via HTTP_REQUEST_TOKEN_CONFIG. Users are advised to upgrade to version 0.8.2 to mitigate the risk associated with this flaw.

Affected Version(s)

Strands Agents Tools 0 < 0.8.2

References

https://github.com/strands-agents/tools/releases/tag/v0.8.2
patch
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory
https://github.com/strands-agents/tools/security/advisori...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.