EUVD-2026-44762Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Three required deployment prerequisites justify AC:H; UI:R reflects mandatory LLM processing of attacker-controlled input; no integrity or availability impact applies.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the elasticsearch_memory tool for agent memory storage. We identified CVE-2026-15746, a server-side request forgery (SSRF) issue in the elasticsearch_memory tool. The tool exposed its connection parameters (es_url, cloud_id, api_key) as fields the large language model (LLM) could control through the tool schema. When a caller omitted the api_key parameter, the tool fell back to the operator's ELASTICSEARCH_API_KEY environment variable and sent it to whichever host the LLM specified. A crafted prompt could cause the tool to connect to a threat-actor-controlled server and disclose the operator's Elasticsearch API key in the Authorization header.
We recommend you upgrade to strands-agents-tools version 0.7.0 or later. As a precautionary measure, we recommend all operators rotate their ELASTICSEARCH_API_KEY, even if there is no indication the credential was exposed.
AnalysisAI
Server-side request forgery in the strands-agents-tools elasticsearch_memory tool enables prompt-injection attacks that exfiltrate the operator's Elasticsearch API key to attacker-controlled infrastructure. Applications using strands-agents-tools prior to 0.7.0 that rely on the ELASTICSEARCH_API_KEY environment-variable fallback - rather than explicitly passing api_key - are exposed to credential theft when an attacker can influence LLM input. No public exploit code or CISA KEV listing has been identified at time of analysis, but the prompt-injection-to-SSRF primitive is well understood in the AI agent security community and the credential-theft impact warrants prompt remediation.
Technical ContextAI
The strands-agents-tools Python package (CPE: cpe:2.3:a:amazon:strands-agents-tools:*:*:*:*:*:*:*:*) provides pre-built tool integrations for Amazon's Strands Agents SDK, including an elasticsearch_memory tool that allows LLM agents to use Elasticsearch as a memory backend. CWE-918 (Server-Side Request Forgery) manifests because the tool exposes its connection parameters - es_url, cloud_id, and api_key - directly within the schema visible to the LLM, making them LLM-controllable inputs rather than operator-only configuration. When a caller omits api_key, the implementation silently falls back to the ELASTICSEARCH_API_KEY process environment variable and sends it in the HTTP Authorization header to whichever host the LLM specifies. This design collapses the trust boundary between operator secrets and LLM-controlled request targets, creating a direct prompt-injection-to-SSRF-to-credential-exfiltration chain that the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H accurately captures.
RemediationAI
The primary fix is to upgrade strands-agents-tools to version 0.7.0 or later via pip install --upgrade strands-agents-tools, confirmed available at https://pypi.org/project/strands-agents-tools/0.7.0/. Per the AWS advisory at https://aws.amazon.com/security/security-bulletins/2026-056-aws/, Amazon recommends all operators rotate their ELASTICSEARCH_API_KEY immediately, regardless of whether exposure is suspected, because SSRF-based credential theft may leave no application-level log trace. As a compensating control prior to patching, operators should explicitly pass the api_key parameter in all elasticsearch_memory tool invocations to prevent the environment-variable fallback from activating - this eliminates the credential-exfiltration path without disabling the tool. Alternatively, removing ELASTICSEARCH_API_KEY from the agent process environment entirely and injecting it at call time via a secrets manager (such as AWS Secrets Manager) prevents the fallback from having a credential to disclose; the trade-off is added operational complexity at each invocation site.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today