CVE-2026-15746: Strands Agents Tools SSRF Vulnerability

CVE-2026-15746 Overview

CVE-2026-15746 is a server-side request forgery (SSRF) vulnerability [CWE-918] in the elasticsearch_memory tool shipped with the strands-agents-tools package. Strands Agents is an open-source Python SDK for building and running AI agents. The tool exposed its Elasticsearch connection parameters (es_url, cloud_id, api_key) as LLM-controllable fields through the tool schema. When a caller omitted the api_key, the tool fell back to the operator's ELASTICSEARCH_API_KEY environment variable and sent it to the host chosen by the large language model (LLM). A crafted prompt could redirect the request to an attacker-controlled server and leak the operator's API key in the Authorization header.

Critical Impact
A prompt-injection-capable attacker can exfiltrate the operator's Elasticsearch API key by directing the agent to connect to an arbitrary host.

Affected Products

strands-agents-tools Python package versions prior to 0.7.0
Strands Agents SDK deployments using the elasticsearch_memory tool
AI agent applications that set ELASTICSEARCH_API_KEY in the environment

Discovery Timeline

2026-07-15 - CVE-2026-15746 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15746

Vulnerability Analysis

The elasticsearch_memory tool provides persistent memory storage for Strands agents by connecting to an Elasticsearch backend. To make the tool usable from an agent conversation, its input schema declared connection parameters such as es_url, cloud_id, and api_key as fields the LLM could populate at invocation time. This design assumes the LLM will act in the operator's interest, which is not a valid trust boundary.

When the LLM invoked the tool without supplying api_key, the tool read the operator's ELASTICSEARCH_API_KEY environment variable and attached it to the outgoing HTTP request. Because the destination host was also LLM-controlled through es_url or cloud_id, the tool would send the operator's credential to any host the model named. An attacker who could influence the model through indirect prompt injection, poisoned tool output, or an untrusted retrieved document could redirect the request.

Root Cause

The root cause is a missing separation between operator-controlled configuration and model-controlled parameters. Connection endpoint and credential material were treated as part of the tool's schema rather than as fixed operator settings. This is a classic SSRF pattern [CWE-918] adapted to the agentic-tool context, where the LLM assumes the role of the untrusted client.

Attack Vector

Exploitation requires that an attacker inject instructions into the agent's context. This may occur through a malicious user prompt, a poisoned document retrieved by the agent, or a compromised upstream tool. The injected content instructs the agent to call elasticsearch_memory with es_url pointing to a threat-actor-controlled endpoint. The tool issues an authenticated HTTPS request carrying the operator's ELASTICSEARCH_API_KEY in the Authorization header, disclosing the credential to the attacker's server. No direct network access to the operator's infrastructure is required.

No public exploit code is available. See the GitHub Security Advisory GHSA-ppcf-fpr3-x46v for the vendor's technical description.

Detection Methods for CVE-2026-15746

Indicators of Compromise

Outbound HTTPS requests from agent hosts to Elasticsearch endpoints that do not match the operator's configured cluster hostnames or Elastic Cloud IDs.
Authorization: ApiKey headers sent to unexpected destinations in egress proxy or TLS-inspection logs.
Agent trace logs showing elasticsearch_memory tool calls whose es_url or cloud_id arguments originated from user or retrieved content.

Detection Strategies

Instrument the Strands Agents runtime to log every elasticsearch_memory invocation with the full argument set, then alert on any host value not on an allowlist.
Correlate LLM tool-call telemetry with egress network flows to identify requests that carry credentials to previously unseen destinations.
Review conversation transcripts for prompt-injection patterns that reference es_url, cloud_id, or api_key.

Monitoring Recommendations

Route all agent egress through a forwarding proxy that enforces a destination allowlist for Elasticsearch traffic.
Enable DNS query logging on agent hosts and alert on lookups for domains that do not match the operator's Elasticsearch infrastructure.
Monitor Elastic Cloud audit logs for API key use from unexpected source IP ranges.

How to Mitigate CVE-2026-15746

Immediate Actions Required

Upgrade strands-agents-tools to version 0.7.0 or later on every host that runs Strands agents.
Rotate the ELASTICSEARCH_API_KEY credential even without evidence of exposure, as recommended by the vendor.
Audit agent egress logs for connections to Elasticsearch endpoints outside the operator's expected cluster.

Patch Information

The fix is available in strands-agents-tools 0.7.0 on PyPI. Additional context is published in the GitHub Security Advisory GHSA-ppcf-fpr3-x46v and the AWS Security Bulletin 2026-056. Rebuild and redeploy any container images that pin an older version.

Workarounds

Remove the elasticsearch_memory tool from agent tool sets until the upgrade is deployed.
Unset ELASTICSEARCH_API_KEY from the agent process environment and pass connection settings through operator-controlled configuration instead of the tool schema.
Restrict agent host egress to an allowlist containing only the operator's Elasticsearch cluster or Elastic Cloud endpoints.

bash

# Upgrade the vulnerable package and remove the credential from the environment
pip install --upgrade 'strands-agents-tools>=0.7.0'
unset ELASTICSEARCH_API_KEY