CVE-2026-15746: Strands Agents elasticsearch_memory tool SSRF exposing Elasticsearch API key

Summary

CVE-2026-15746 is a server-side request forgery (SSRF) issue in the elasticsearch_memory tool of the strands-agents-tools package, which ships with the Strands Agents Python SDK. The tool exposed es_url, cloud_id and api_key as fields the LLM could control through the tool schema. When api_key was omitted, the tool fell back to the operator's ELASTICSEARCH_API_KEY environment variable and sent it to a host the LLM specified, so a crafted prompt could leak that key to an attacker-controlled server in the Authorization header.

Mitigation

Upgrade strands-agents-tools to version 0.7.0 or later. As a precaution, rotate ELASTICSEARCH_API_KEY, even without evidence that it was exposed.

Topics

• AI agents

Related items

• MediumAI coding agents expose developer screenshots on GitHub reposSimilar attack · ReversingLabs Blog
• InfoHow to Secure AI Models in Production Environments | Endor LabsSimilar attack · Endor Labs Blog
• InfoLLM Development Risks: Security Threats and Mitigation Strategies | Endor LabsSimilar attack · Endor Labs Blog
• InfoWhen Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoStrengthening our defenses against distillation attacksSimilar attack · Anthropic Research Blog