PT-2026-66844 · Aws · Strands-Agents-Tools

CVE-2026-18394 · Publicado 2026-07-31 · Atualizado 2026-07-31

NVD

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Incorrect authorization in the http request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP REQUEST TOKEN CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure.

To remediate this issue, users should upgrade to version 0.8.2.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-18394

Produtos afetados

Strands-Agents-Tools

Referências · 4

• https://github.com/strands-agents/tools/security/advisories/GHSA-qhw6-2h72-m84v · Nota
• https://github.com/strands-agents/tools/releases/tag/v0.8.2 · Correção
• https://aws.amazon.com/security/security-bulletins/2026-069-aws · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-18394 · Nota de Segurança