CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2026-18394 - Incorrect authorization in Strands Agents Tools http_request tool

unknownCVE-2026-18394
Bulletin ID: 2026-069-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/31/2026 12:30 PM PDT Description: Strands Agents is an open-source SDK for building AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the http_request tool for making HTTP API requests. We identified CVE-2026-18394, an incorrect authorization issue in the http_request tool. Operators can use the HTTP_REQUEST_TOKEN_CONFIG allowlist to bind a credential to a set of approved hostnames so it is sent only to those hosts. The tool also exposed a proxies parameter in the input schema that the large language model (LLM) could control. A crafted prompt, for example one delivered through untrusted web content the agent reads (indirect prompt injection), could set proxies to an actor-controlled endpoint. The hostname allowlist check still passes on the request URL, the credential is attached, and the request is routed through the actor's proxy on the first hop, disclosing the credential in cleartext in the Authorization header. Impacted versions: < 0.8.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: Strandsproduct: Strands Agents ToolsAuthentication bypass
What
The http_request tool's authorization check for HTTP_REQUEST_TOKEN_CONFIG credential allowlist can be bypassed by crafting prompts that control the proxies parameter to redirect requests through attacker-controlled endpoints.
Who is affected
Deployments using the http_request tool with HTTP_REQUEST_TOKEN_CONFIG allowlists and LLM-controllable inputs are affected.
Urgency
Moderate urgency; indirect prompt injection through untrusted content can exploit the authorization bypass, but no active exploitation reported.
Action
Update strands-agents-tools package to a patched version that removes LLM control over the proxies parameter or enforces allowlist validation on proxy endpoints.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Strands Agents Tools

Get an email when a new Strands Agents Tools advisory drops — max one per day, one-click unsubscribe.

Details

Source
AWS Security Bulletins (INTL · vendor-psirt · site)
Severity
unknown
Published
2026-08-20
Exploitation
Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-069-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-18394coverage & exploitation statusNVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for - Incorrect authorization

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from AWS Security Bulletins