CVE-2026-15746

Awaiting Analysis Awaiting Analysis - Queue

SSRF in Strands Agents Tools Elasticsearch Memory

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: AMZN

Description

Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the elasticsearch_memory tool for agent memory storage. We identified CVE-2026-15746, a server-side request forgery (SSRF) issue in the elasticsearch_memory tool. The tool exposed its connection parameters (es_url, cloud_id, api_key) as fields the large language model (LLM) could control through the tool schema. When a caller omitted the api_key parameter, the tool fell back to the operator's ELASTICSEARCH_API_KEY environment variable and sent it to whichever host the LLM specified. A crafted prompt could cause the tool to connect to a threat-actor-controlled server and disclose the operator's Elasticsearch API key in the Authorization header. We recommend you upgrade to strands-agents-tools version 0.7.0 or later. As a precautionary measure, we recommend all operators rotate their ELASTICSEARCH_API_KEY, even if there is no indication the credential was exposed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-15746

EUVD

EUVD-2026-44762

Affected Vendors & Products

Vendor	Product	Version / Range
strands_agents	tools	to 0.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-15746 is a server-side request forgery (SSRF) vulnerability in the elasticsearch_memory tool of the Strands Agents Tools package. The tool exposed connection parameters like es_url, cloud_id, and api_key to control by a large language model (LLM) through the tool schema. When the api_key parameter is omitted, the tool uses the operator's ELASTICSEARCH_API_KEY environment variable and sends it to a host specified by the LLM. A malicious prompt could trick the tool into connecting to a threat actor's server, exposing the Elasticsearch API key in the Authorization header.

Detection Guidance

To detect this vulnerability, check if your system is running strands-agents-tools versions prior to 0.7.0. Use commands like 'pip show strands-agents-tools' or 'pip list' to verify the installed version. Monitor network traffic for unexpected outbound connections from the elasticsearch_memory tool to untrusted hosts.

Impact Analysis

This vulnerability could allow an attacker to steal your Elasticsearch API key by tricking the elasticsearch_memory tool into connecting to a server they control. The exposed key could then be used to access your Elasticsearch data, potentially leading to data breaches or unauthorized modifications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. A data breach resulting from this issue may require reporting under these regulations, potentially leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade strands-agents-tools to version 0.7.0 or later. Rotate your ELASTICSEARCH_API_KEY as a precaution. Temporarily avoid using the elasticsearch_memory tool until upgraded or restrict outbound network access to trusted Elasticsearch endpoints.

Hi! I’m here to help you understand CVE-2026-15746. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70