Bulletin ID: 2026-069-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 07/31/2026 12:30 PM PDT

Description:

Strands Agents is an open-source SDK for building AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the http_request tool for making HTTP API requests.

We identified CVE-2026-18394, an incorrect authorization issue in the http_request tool. Operators can use the HTTP_REQUEST_TOKEN_CONFIG allowlist to bind a credential to a set of approved hostnames so it is sent only to those hosts. The tool also exposed a proxies parameter in the input schema that the large language model (LLM) could control. A crafted prompt, for example one delivered through untrusted web content the agent reads (indirect prompt injection), could set proxies to an actor-controlled endpoint. The hostname allowlist check still passes on the request URL, the credential is attached, and the request is routed through the actor's proxy on the first hop, disclosing the credential in cleartext in the Authorization header.

Impacted versions: < 0.8.2

Resolution:

This issue has been addressed in strands-agents-tools version 0.8.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. As a precautionary measure, we recommend all operators who configured credentials via HTTP_REQUEST_TOKEN_CONFIG on affected versions rotate those credentials, even if there is no indication a credential was exposed.

Workarounds:

Until you can upgrade, do not bind credentials with HTTP_REQUEST_TOKEN_CONFIG when the http_request tool is available to an agent that processes untrusted content, and configure any required proxies out of band through the HTTP_PROXY and HTTPS_PROXY environment variables rather than through the tool.

References:

• CVE-2026-18394
• GHSA-qhw6-2h72-m84v

Please email aws-security@amazon.com with any security questions or concerns.