AWS patches credential leak in Strands Agents elasticsearch_memory tool
An SSRF flaw in the open-source SDK allowed LLMs to exfiltrate Elasticsearch API keys to attacker-controlled servers.
Key points
- CVE-2026-15746 allows credential disclosure via server-side request forgery in Strands Agents Tools.
- The elasticsearch_memory tool sent operator API keys to hosts specified by the large language model.
- AWS released version 0.7.0 on July 15, 2026, to address the vulnerability in the Python SDK.
AWS published a security bulletin on July 15, 2026, detailing a credential disclosure vulnerability in its open-source Strands Agents SDK. The issue, tracked as CVE-2026-15746, affects the elasticsearch_memory tool within the strands-agents-tools package and allows attackers to steal Elasticsearch API keys through server-side request forgery.
The vulnerability exists because the tool exposed connection parameters, including es_url, cloud_id, and api_key, as fields controllable by the large language model via the tool schema. When a caller did not provide an api_key parameter, the tool defaulted to using the operator's ELASTICSEARCH_API_KEY environment variable and transmitted it to the host specified by the LLM.
Technical Context and Background
According to the AWS Security Bulletin, a threat actor could craft a prompt that instructs the tool to connect to a server under their control. This action would cause the tool to send the operator's Elasticsearch API key in the Authorization header to that malicious host. The flaw stems from the tool's fallback mechanism, which prioritized the environment variable when the explicit parameter was omitted during the connection attempt.
This issue has been resolved in strands-agents-tools version 0.7.0. AWS advises that all users upgrade to this latest version immediately. The vendor also recommends ensuring that any forked or derivative code incorporates the new fixes to prevent similar exposure in custom implementations of the SDK.
Who Is Affected
Strands Agents is an open-source Python SDK designed for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, with the elasticsearch_memory tool specifically intended for agent memory storage. Any operator using versions prior to 0.7.0 who has exposed the ELASTICSEARCH_API_KEY environment variable to the tool is potentially affected by this credential disclosure risk.
AWS classifies this bulletin as important and requiring attention. The company recommends that all operators rotate their ELASTICSEARCH_API_KEY as a precautionary measure, even if there is no specific indication that the credential was previously exposed or compromised through this vulnerability.
What should you do?
Users should avoid using the elasticsearch_memory tool until they have upgraded to version 0.7.0 or later. If continuing to run an affected version is necessary, operators must not expose the ELASTICSEARCH_API_KEY environment variable to the tool. Additionally, restricting outbound network access so the agent host can reach only trusted Elasticsearch endpoints can mitigate the risk of data exfiltration to unauthorized servers.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: AWS
- Update the strands-agents-tools package to version 0.7.0 or later to apply the vendor's fix for CVE-2026-15746.
- Rotate the ELASTICSEARCH_API_KEY environment variable immediately to invalidate any potentially compromised credentials.
- Restrict outbound network access from agent hosts to ensure they can only communicate with trusted Elasticsearch endpoints.
- Audit forked or derivative codebases to ensure they incorporate the security patches provided in the latest SDK release.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-15746?
It is a server-side request forgery vulnerability in the Strands Agents Tools elasticsearch_memory tool that allows credential disclosure.
When was the fix released?
AWS addressed the issue in strands-agents-tools version 0.7.0, published on July 15, 2026.
How can the API key be stolen?
A crafted prompt can cause the tool to connect to an attacker-controlled server and send the API key in the Authorization header.
