CVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory tool

unknownCVE-2026-15746

Bulletin ID: 2026-056-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/15/2026 11:30 AM PDT Description: Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the elasticsearch_memory tool for agent memory storage. We identified CVE-2026-15746, a server-side request forgery (SSRF) issue in the elasticsearch_memory tool. The tool exposed its connection parameters (es_url, cloud_id, api_key) as fields the large language model (LLM) could control through the tool schema. When a caller omitted the api_key parameter, the tool fell back to the operator's ELASTICSEARCH_API_KEY environment variable and sent it to whichever host the LLM specified. A crafted prompt could cause the tool to connect to a threat-actor-controlled server and disclose the operator's Elasticsearch API key in the Authorization header. Impacted versions: < 0.7.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: Strands product: strands-agents-tools Server-side request forgery

What: A server-side request forgery (SSRF) issue in the elasticsearch_memory tool could expose sensitive connection parameters.
Who is affected: Users of the strands-agents-tools package are affected by this vulnerability.
Urgency: Remediation urgency is unclear as the severity is marked as important but not critical.
Action: Update to the latest version of strands-agents-tools to mitigate the vulnerability.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch strands-agents-tools

Get an email when a new strands-agents-tools advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-15
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-056-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-157460.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-15746	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

mediumCVE-2026-15746: Strands Agents is an open-source Python SDK for building and running AI agents. The strands-ag…nvd

Recent advisories for - Credential disclosure

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-67357: ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get…nvd · 2026-08-02
mediumCVE-2026-9335: A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content…nvd · 2026-08-02
mediumCVE-2026-67354: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in Re…nvd · 2026-08-01
mediumCVE-2026-67292: FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket…nvd · 2026-08-01
mediumCVE-2025-14073: The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Di…nvd · 2026-08-01
mediumGHSA-22p9-r2f5-22mf: OnionShare follows symlinks in shared directories, allowing unintended disclosure of loca…ghsa · 2026-07-31