What’s Vulnerable › Vulnerabilities

CVE-2026-18394: Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-31 · updated 2026-10-23
• Weakness: CWE-863

Description

Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users should upgrade to version 0.8.2.

Affected products

• AWS Strands Agents Tools: before 0.8.2 — fixed in 0.8.2

How to fix

Upgrade to a fixed version: AWS Strands Agents Tools 0.8.2. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/2026-069-aws/
• https://github.com/strands-agents/tools/releases/tag/v0.8.2
• https://github.com/strands-agents/tools/security/advisories/GHSA-qhw6-2h72-m84v

Get alerted when CVE-2026-18394 or the next vulnerability affects your stack