Strands Agents Tools CVE-2026-18394

Exploitation requires three simultaneous conditions: (1) the target application must have HTTP_REQUEST_TOKEN_CONFIG set with active bearer token or authentication credentials - deployments without token configuration are not at risk of credential theft; (2) the application must run a version of Strands Agents Tools prior to v0.8.2, where the proxy field is present in the LLM-controllable http_request schema; and (3) an attacker must be able to influence LLM reasoning via prompt injection - through external content the agent fetches, adversarial user input, or data retrieved from attacker-controlled sources. The CVSS PR:N metric confirms no authentication to the Strands agent framework itself is required to introduce the injection. Closed deployments that process only fully trusted, operator-controlled inputs are not at material risk even when credentials are configured.

The CVSS 7.4 base score (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) accurately characterizes a network-reachable, scope-changed credential theft scenario. The S:C and C:H combination reflects that stolen credentials extend attacker reach beyond the agent itself to downstream APIs and services. UI:R maps to the requirement that the LLM process attacker-controlled content - a realistic precondition in any agent ingesting external data. No EPSS score was provided in the input data, so exploitation probability cannot be independently quantified. The absence of a KEV listing and no identified public POC suggest this has not been observed as an opportunistic attack vector. Real-world risk is gated by two simultaneous requirements: HTTP_REQUEST_TOKEN_CONFIG must be configured, and attacker-influenced content must reach the LLM's reasoning pipeline. Deployments without credential configuration or with fully closed input pipelines carry minimal practical risk despite the high CVSS score. No conflicting signals between CVSS vector and description were identified.

An attacker embeds a prompt injection payload in content the agent will retrieve and process - such as a webpage, API response, or document - that instructs the LLM to configure the attacker's server as the HTTP proxy for subsequent tool calls. When the agent subsequently invokes http_request with credentials attached via HTTP_REQUEST_TOKEN_CONFIG, those tokens are transmitted through and captured by the attacker's proxy. No public POC has been identified at time of analysis, but the technique is consistent with well-documented indirect prompt injection patterns in LLM agent frameworks.