Which versions of Strands Agents Tools are affected by CVE-2026-19111?

Versions of Amazon Strands Agents Tools prior to 0.8.3 contain a cross-tenant isolation vulnerability in multi-tenant memory backends, allowing unauthorized read, write, and delete access to other…. A patch is available.

How to fix or mitigate CVE-2026-19111?

Within 24 hours, identify all systems running Amazon Strands Agents Tools before version 0.8.3 and confirm whether multi-tenant deployments with MongoDB, Elasticsearch, or mem0 memory backends are in use; document the affected tenant count and sensitivity of stored data. Within 7 days, upgrade all affected systems to vendor-released patch version 0.8.3 and validate that cross-tenant isolation has been restored through access control testing. Within 30 days, conduct a 90-day retroactive audit of memory backend access logs to identify any unauthorized cross-tenant data access or manipulation that may have occurred.

Strands Agents Tools CVE-2026-19111

Q: What is the CVSS score of CVE-2026-19111?

CVE-2026-19111 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-54214 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-06 ff89ba41-3aa1-4d27-914a-91399e9639e5

Authentication Bypass

8.6

CVSS 4.0 · Vendor: ff89ba41-3aa1-4d27-914a-91399e9639e5

Severity by source

Vendor (ff89ba41-3aa1-4d27-914a-91399e9639e5) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Scope changed because attacker accesses other tenants' data outside their authorization boundary; PR:L for authenticated users; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ff89ba41-3aa1-4d27-914a-91399e9639e5).

CVSS VectorVendor: ff89ba41-3aa1-4d27-914a-91399e9639e5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 23:07 vuln.today

Patch available

Aug 06, 2026 - 23:03 EUVD

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 8.6

DescriptionCVE.org

Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter.

To remediate this issue, users should upgrade to version 0.8.3.

AnalysisAI

Cross-tenant insecure direct object reference in Amazon Strands Agents Tools' memory backends exposes multi-tenant deployments to unauthorized read, write, and delete operations on other tenants' stored memories. Authenticated users of versions before 0.8.3 can influence the LLM intermediary to emit tool calls carrying a forged namespace parameter, bypassing tenant isolation in mongodb_memory, elasticsearch_memory, and mem0_memory. No public exploit code or CISA KEV listing exists at time of analysis; the vendor-released fix is version 0.8.3.

Technical ContextAI

Amazon Strands Agents Tools is an AWS SDK for building LLM-powered agentic applications. The three affected tools - mongodb_memory, elasticsearch_memory, and mem0_memory - implement persistent memory storage partitioned by a namespace parameter to enforce tenant isolation in shared deployments. CWE-639 (Authorization Through User-Controlled Key) identifies the root cause: the namespace value controlling which tenant's memory partition is accessed is not independently validated server-side against the authenticated caller's identity. Because the LLM acts as an intermediary that translates user prompts into structured tool calls, an attacker can craft inputs (prompt injection) that cause the model to emit tool calls referencing arbitrary tenant namespaces. The affected CPE range per EUVD-2026-54214 is strands-agents-tools versions 0 through below 0.8.3 on PyPI.

RemediationAI

Upgrade strands-agents-tools to version 0.8.3 or later, which is available on PyPI at https://pypi.org/project/strands-agents-tools/0.8.3/ and confirmed by the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-077-aws/. For deployments that cannot immediately upgrade, compensating controls should include restricting the namespace parameter to a server-enforced value derived from the authenticated user's identity at the application layer before the tool call is dispatched - do not allow the LLM-generated tool call to supply the namespace unchecked. Additionally, operators should implement LLM output validation or guardrails that reject tool calls referencing namespaces not owned by the requesting principal; note that prompt-injection defenses are imperfect and should not be treated as a substitute for patching. Logging all cross-namespace tool call attempts can aid detection while remediation is pending.