Which versions of Strands Agents Tools are affected by CVE-2026-18394?

AWS Strands Agents Tools before version 0.8.2 exposes authentication credentials through prompt injection attacks that manipulate HTTP request proxies.. A patch is available.

How to fix or mitigate CVE-2026-18394?

Within 24 hours, conduct inventory of AWS Strands Agents Tools deployments and identify instances that make HTTP requests using bearer token authentication and accept external input or allow prompt manipulation. Within 7 days, upgrade all affected deployments to AWS Strands Agents Tools version 0.8.2 or later, and rotate or revoke any bearer tokens that may have been exposed prior to patching. Within 30 days, review proxy configurations across all agents, implement monitoring for abnormal proxy traffic patterns, and conduct audit log review to identify any unauthorized API calls made with exposed credentials.

Strands Agents Tools CVE-2026-18394

Q: What is the CVSS score of CVE-2026-18394?

CVE-2026-18394 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51623 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-31 AMZN

Authentication Bypass Strands Agents Tools

6.9

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

6.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

Network-reachable via prompt injection with no required privileges; UI:R reflects the LLM must process attacker content; S:C and C:H capture cross-boundary credential exfiltration to downstream services.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jul 31, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

Jul 31, 2026 - 20:22 NVD

7.4 (HIGH) 6.9 (MEDIUM)

Source Code Evidence Fetched

Jul 31, 2026 - 20:16 vuln.today

Analysis Generated

Jul 31, 2026 - 20:16 vuln.today

CVE Published

Jul 31, 2026 - 19:34 cve.org

HIGH 7.4

DescriptionCVE.org

Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure.

To remediate this issue, users should upgrade to version 0.8.2.

AnalysisAI

Credential exfiltration in AWS Strands Agents Tools before 0.8.2 exposes HTTP_REQUEST_TOKEN_CONFIG bearer tokens to attacker-controlled proxy infrastructure by exploiting the LLM's ability to set proxy parameters within the http_request tool's input schema. The root cause (CWE-863: Incorrect Authorization) is that proxy configuration was included as an LLM-controllable field, enabling prompt injection attacks to redirect credentialed HTTP requests through adversary infrastructure. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires three simultaneous conditions: (1) the target application must have HTTP_REQUEST_TOKEN_CONFIG set with active bearer token or authentication credentials - deployments without token configuration are not at risk of credential theft; (2) the application must run a version of Strands Agents Tools prior to v0.8.2, where the proxy field is present in the LLM-controllable http_request schema; and (3) an attacker must be able to influence LLM reasoning via prompt injection - through external content the agent fetches, adversarial user input, or data retrieved from attacker-controlled sources. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.4 base score (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) accurately characterizes a network-reachable, scope-changed credential theft scenario. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Strands Agents Tools v0.8.2, which removes the proxy field from the LLM-controllable tool input schema as confirmed in the release at https://github.com/strands-agents/tools/releases/tag/v0.8.2 and the AWS vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-069-aws/. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct inventory of AWS Strands Agents Tools deployments and identify instances that make HTTP requests using bearer token authentication and accept external input or allow prompt manipulation. …

Threat intelligence, references, and detailed analysis are available after sign-in.