CVE-2026-18394: Strands Agents Tools Auth Bypass Flaw

CVE-2026-18394 Overview

CVE-2026-18394 is an incorrect authorization vulnerability [CWE-863] in the http_request tool of Strands Agents Tools versions before 0.8.2. The flaw allows remote attackers to obtain credentials configured via the HTTP_REQUEST_TOKEN_CONFIG environment variable. Exploitation requires influencing the underlying Large Language Model (LLM) to route outbound requests through actor-controlled proxy infrastructure. Once traffic is redirected, the tool discloses tokens intended only for approved endpoints. The issue affects agentic AI deployments that use the Strands Agents framework for HTTP-based tool invocation.

Critical Impact
Attackers who can influence LLM prompts can exfiltrate authentication tokens configured for the http_request tool by rerouting requests through attacker-controlled proxies.

Affected Products

Strands Agents Tools versions prior to 0.8.2
Applications embedding the http_request tool with HTTP_REQUEST_TOKEN_CONFIG credentials
AWS-referenced deployments per Security Bulletin 2026-069

Discovery Timeline

2026-07-31 - CVE-2026-18394 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18394

Vulnerability Analysis

The http_request tool in Strands Agents Tools reads credential material from the HTTP_REQUEST_TOKEN_CONFIG configuration and attaches it to outbound HTTP requests. The tool does not correctly verify that the destination of a given request matches the authorization scope associated with the configured token. An LLM operating the tool can be influenced through prompt injection or untrusted content to select an actor-controlled destination. When the tool forwards the request, it also forwards the credential to the attacker-controlled endpoint. This class of weakness is tracked as CWE-863 (Incorrect Authorization) and represents a broader risk pattern in agentic AI tool wrappers that bind secrets to tool identities rather than to specific destinations.

Root Cause

The root cause is missing destination-scope enforcement between configured credentials and the target URL selected at inference time. The tool trusts the LLM-provided URL and attaches the token without validating whether the destination is authorized to receive it. Because the LLM's choice of URL is influenced by upstream prompts, tool outputs, and retrieved content, untrusted input effectively controls credential routing.

Attack Vector

A remote attacker delivers crafted content (a webpage, document, retrieved API response, or chat message) that steers the agent to invoke http_request against a proxy or endpoint the attacker controls. The attacker does not need direct access to the agent host. Because user interaction is required to trigger the affected agent flow, exploitation depends on the agent processing attacker-influenced content. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-qhw6-2h72-m84v.

// No verified proof-of-concept code is published for CVE-2026-18394.
// Refer to the vendor advisory for technical details.

Detection Methods for CVE-2026-18394

Indicators of Compromise

Outbound HTTP requests from agent hosts to domains outside the approved integration list
Authorization or bearer token headers appearing in traffic destined for unrecognized hosts
Agent trace logs showing http_request invocations with URLs sourced from untrusted retrieved content
Repeated tool calls to attacker-controlled proxies followed by anomalous credential use downstream

Detection Strategies

Correlate agent execution logs with egress proxy logs to identify http_request destinations that fall outside an allow list
Inspect prompts and tool arguments for indicators of prompt injection that reference alternate URLs or proxy hosts
Monitor for reuse of tokens defined in HTTP_REQUEST_TOKEN_CONFIG from IP addresses that do not match the agent runtime

Monitoring Recommendations

Log every http_request invocation with the full destination URL and originating prompt context
Alert on new or previously unseen fully qualified domain names contacted by agent workloads
Rotate and monitor use of any token that may have been exposed to an untrusted destination

How to Mitigate CVE-2026-18394

Immediate Actions Required

Upgrade Strands Agents Tools to version 0.8.2 or later
Rotate all credentials configured via HTTP_REQUEST_TOKEN_CONFIG if the agent processed untrusted content while running an affected version
Review agent execution history for http_request calls to unexpected destinations
Restrict egress from agent runtimes to an explicit allow list of approved API endpoints

Patch Information

The maintainers released the fix in Strands Agents Tools v0.8.2. Additional guidance is provided in AWS Security Bulletin 2026-069 and the GitHub Security Advisory GHSA-qhw6-2h72-m84v.

Workarounds

Remove or unset HTTP_REQUEST_TOKEN_CONFIG until the upgrade to 0.8.2 is complete
Enforce a destination allow list at the network layer so tokens cannot reach unauthorized hosts
Filter and sanitize retrieved content passed to the LLM to reduce prompt-injection exposure

bash

# Upgrade Strands Agents Tools to the patched release
pip install --upgrade 'strands-agents-tools>=0.8.2'

# Verify installed version
pip show strands-agents-tools | grep -i version