AWS fixes SSRF flaw leaking Elasticsearch keys in Strands Agents

A server-side request forgery vulnerability in AWS Strands Agents allowed attackers to steal Elasticsearch API keys. The flaw existed in the elasticsearch_memory tool, which is part of the strands-agents-tools package. According to the AWS Security Bulletin published on July 15, 2026, a threat actor could manipulate the tool into sending sensitive credentials to a server they controlled. This exposure occurred when the large language model directed the tool to connect to an arbitrary host rather than the intended database.

In plain English

The Strands Agents SDK includes pre-built tools for AI agents, including one for storing memory in Elasticsearch. The elasticsearch_memory tool was designed to accept connection parameters from the large language model. However, the tool schema allowed the model to specify the destination URL. If the caller did not provide an API key directly, the tool automatically used the operator’s ELASTICSEARCH_API_KEY environment variable. This meant the secret key was sent to whatever host the model was tricked into targeting.

The background

AWS identified CVE-2026-15746 as an important security issue requiring attention. The vulnerability stemmed from how the tool handled missing parameters. When the api_key parameter was omitted, the fallback mechanism retrieved the environment variable and included it in the Authorization header for the outbound connection. A crafted prompt could cause the tool to initiate a connection to a threat-actor-controlled server. This action disclosed the operator’s Elasticsearch API key in the process, compromising the credential’s integrity.

What changes now

AWS has addressed the issue in strands-agents-tools version 0.7.0. The company recommends upgrading to this latest version immediately. Operators should also ensure that any forked or derivative code incorporates these new fixes. As a precautionary measure, AWS advises all operators to rotate their ELASTICSEARCH_API_KEY. This recommendation applies even if there is no indication that the credential was actually exposed. Users should avoid using the affected tool until they have completed the upgrade process.

What made it possible

Teams usually isolate AI agent environments to prevent unauthorized network access. This incident highlights the risk of allowing models to control network destinations without strict validation. Check whether your agent tools restrict outbound connections to predefined, trusted endpoints only. Ensure that sensitive environment variables are never passed to tools that can accept arbitrary URLs. Verify that your deployment pipeline enforces least-privilege network rules for all agent hosts to limit exposure from similar configuration errors.

What to do and how to stay safe: AWS

• Upgrade the strands-agents-tools package to version 0.7.0 or later to apply the vendor fix.
• Rotate your ELASTICSEARCH_API_KEY immediately, even if you have no evidence of compromise.
• Restrict outbound network access for agent hosts so they can only reach trusted Elasticsearch endpoints.
• Avoid exposing the ELASTICSEARCH_API_KEY environment variable to the tool if you must run an affected version temporarily.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-15746?

It is a server-side request forgery vulnerability in the Strands Agents elasticsearch_memory tool that allows credential disclosure.

Which version of the tool fixes this issue?

The issue has been addressed in strands-agents-tools version 0.7.0.

Should I rotate my API key if I haven't been attacked?

Yes, AWS recommends all operators rotate their ELASTICSEARCH_API_KEY as a precautionary measure.