PT-2026-66844 · Aws · Strands-Agents-Tools

CVE-2026-18394 · Published 2026-07-31 · Updated 2026-07-31

NVD

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Incorrect authorization in the http request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP REQUEST TOKEN CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure.

To remediate this issue, users should upgrade to version 0.8.2.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-18394

Affected Products

Strands-Agents-Tools

References · 4

• https://github.com/strands-agents/tools/releases/tag/v0.8.2 · Patch
• https://aws.amazon.com/security/security-bulletins/2026-069-aws · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-18394 · Security Note
• https://github.com/strands-agents/tools/security/advisories/GHSA-qhw6-2h72-m84v · Note