AWS Fixes Auth Bypass in Strands Agents Tools via CVE-2026-18394
Amazon resolved a credential-leak flaw in its open-source AI agent SDK that allowed prompts to hijack HTTP requests through unauthorized proxies.
Key points
- CVE-2026-18394 permits indirect prompt injection to route authenticated requests via attacker-controlled proxies.
- Credentials defined in HTTP_REQUEST_TOKEN_CONFIG are exposed in cleartext Authorization headers during the attack.
- AWS released strands-agents-tools version 0.8.2 to fix the issue and urges immediate credential rotation.
Amazon Web Services published bulletin 2026-069-AWS on July 31, 2026, to address an incorrect authorization vulnerability designated as CVE-2026-18394. The flaw affects the http_request tool within the open-source Strands Agents Tools package. The issue allows malicious actors to intercept credentials by manipulating how the agent handles proxy configurations.
The vulnerability arises because the large language model can control the proxies parameter in the input schema. An attacker can use indirect prompt injection, such as embedding malicious instructions in untrusted web content, to set this parameter to an endpoint they control. Although the hostname allowlist check passes for the target URL, the request is routed through the attacker’s proxy on the initial hop.
Technical Details of the Flaw
According to the AWS Security Bulletins, operators typically use the HTTP_REQUEST_TOKEN_CONFIG allowlist to bind credentials to specific approved hostnames. This mechanism is designed to ensure credentials are sent only to those designated hosts. However, the http_request tool previously permitted the model to override proxy settings via its input schema.
When a crafted prompt sets the proxies field to an actor-controlled endpoint, the credential attachment logic remains active. The request reaches the attacker’s server first, exposing the credential in cleartext within the Authorization header. This occurs before the request is forwarded to the intended destination, bypassing the intended security boundary of the allowlist.
Affected Versions and Scope
Strands Agents is an open-source software development kit designed for building artificial intelligence agents. The strands-agents-tools package provides pre-built utilities for these agents, including the http_request tool for making external API calls. The vulnerability exists in versions of this package prior to 0.8.2.
AWS classifies the bulletin as important, requiring attention. The issue does not involve a direct compromise of AWS infrastructure but rather a logical error in how the client-side tool handles user-controllable inputs. Any deployment using affected versions of the SDK where agents process untrusted content is potentially at risk of credential exposure.
What should you do?
AWS has addressed the issue in strands-agents-tools version 0.8.2. The vendor recommends upgrading to the latest version immediately. Operators must also ensure that any forked or derivative code incorporates these fixes. Until an upgrade is possible, users should avoid binding credentials with HTTP_REQUEST_TOKEN_CONFIG if the agent processes untrusted content. Additionally, configure required proxies via environment variables like HTTP_PROXY instead of the tool.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: AWS
- Upgrade the strands-agents-tools package to version 0.8.2 or later to apply the vendor-provided fix for the authorization bypass.
- Rotate all credentials configured via HTTP_REQUEST_TOKEN_CONFIG on affected versions, assuming they may have been compromised, even without evidence of exposure.
- Audit agent configurations to ensure proxies are set through HTTP_PROXY and HTTPS_PROXY environment variables rather than through the tool's input schema.
- Monitor agent logs for unexpected proxy configurations or requests routed to unfamiliar endpoints that may indicate indirect prompt injection attempts.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-18394?
It is an incorrect authorization vulnerability in the Strands Agents Tools http_request tool that allows indirect prompt injection to route requests through attacker-controlled proxies.
Which versions are affected?
All versions of the strands-agents-tools package prior to 0.8.2 are affected by this credential-leak issue.
How should I mitigate the risk before patching?
Do not bind credentials with HTTP_REQUEST_TOKEN_CONFIG when agents process untrusted content, and configure proxies via environment variables instead of the tool.
