Strands Agents Tools vulnerabilities

2 known vulnerabilities in Strands Agents Tools from AWS. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  strands-agents-tools: Authorization Bypass Through User-Controlled Key

  CVE-2026-19111Aug 6, 2026AWS

  Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influenci

• 7.4 High severity

  Strands Agents Tools: Incorrect Authorization

  CVE-2026-18394Jul 31, 2026AWS

  Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastruc