strands-agents-tools CVE-2026-15746

Exploitation requires four concurrent conditions to be true simultaneously: (1) the target application uses the strands-agents-tools elasticsearch_memory tool, (2) the ELASTICSEARCH_API_KEY environment variable is populated in the agent process, (3) the caller does not explicitly pass the api_key argument - triggering the environment-variable fallback that sends the credential to the LLM-specified host - and (4) an attacker can influence the content the LLM processes, either through direct user input, retrieved external documents, or injected tool output. Applications that always supply api_key explicitly are not affected, as the fallback is never invoked. Exploitation is bounded by CVSS UI:A: the LLM must actively process attacker-influenced prompts, meaning purely batch or isolated agent deployments without external input channels are not directly exploitable through this vector.

The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) scores 6.9 (Medium), reflecting high confidentiality impact against the vulnerable system but requiring active user interaction (UI:A) - in practice, the LLM must process attacker-influenced content. No EPSS score is present in the available data, so exploitation likelihood cannot be quantified statistically. The absence of a KEV listing means CISA has not confirmed in-the-wild exploitation. However, the confidentiality-only CVSS impact (C:H/I:N/A:N) may understate real-world risk: a stolen Elasticsearch API key can enable an attacker to read, modify, or delete index data far beyond the initial compromise, representing significant lateral-movement potential. The vendor's choice of AT:N is debatable - exploitation requires three concurrent deployment conditions (tool in use, env var set, api_key not explicitly passed), which arguably fits AT:P in CVSS 4.0 and AC:H in CVSS 3.1. This is explicitly noted as an area of metric uncertainty. The strongest mitigating factor is population size: strands-agents-tools is a relatively new, niche AI agent SDK with limited enterprise deployment breadth.

An attacker embeds a crafted instruction in content the LLM processes - such as a malicious document retrieved from a user-supplied URL, adversarial user message, or poisoned tool output - directing the elasticsearch_memory tool to connect to an attacker-controlled HTTPS endpoint by overriding the es_url parameter. Because the operator omitted the explicit api_key argument, the tool appends the ELASTICSEARCH_API_KEY environment variable to the Authorization header of the outbound HTTP request, where the attacker's server logs and exfiltrates it. No public proof-of-concept exploit has been identified, but the technique directly mirrors documented prompt injection attacks that manipulate LLM tool schemas to redirect network calls.