Key points
- CVE-2026-18394 affects strands-agents-tools versions prior to 0.8.2.
- The http_request tool exposes credentials to actor-controlled proxies.
- AWS released version 0.8.2 to fix the authorization bypass.
Security teams managing AI agent infrastructure must address CVE-2026-18394 in the Strands Agents Tools package. AWS published bulletin 2026-069-AWS on July 31, 2026, detailing an incorrect authorization flaw. The vulnerability exists in the http_request tool, which handles HTTP API calls for agents built with the open-source SDK. Operators using this tool to bind credentials to specific hostnames are at risk if their agents process untrusted content.
In plain English
The http_request tool allows developers to attach authentication tokens to requests destined for approved servers. This is controlled by the HTTP_REQUEST_TOKEN_CONFIG allowlist. However, the tool also accepted a proxies parameter that the underlying large language model could modify. If an agent reads malicious web content, it might change the proxy setting to point at an attacker’s server. The authorization check only verifies the final destination, not the intermediate proxy. Consequently, the tool sends the credential in cleartext through the attacker’s endpoint before reaching the intended host.
The background
Strands Agents is an open-source SDK designed for building AI agents. The strands-agents-tools package supplies pre-built utilities, including the http_request tool. AWS identified that the input schema for this tool permitted the LLM to control proxy configurations dynamically. This design allowed indirect prompt injection attacks to route traffic through arbitrary endpoints. The hostname validation logic did not account for the first hop being a proxy, leading to credential disclosure. This issue has been resolved in version 0.8.2 of the package.
What changes now
AWS recommends upgrading to strands-agents-tools version 0.8.2 immediately. Teams should also patch any forked or derivative code to include these fixes. As a precautionary measure, AWS advises rotating any credentials configured via HTTP_REQUEST_TOKEN_CONFIG on affected versions, even without evidence of compromise. Until upgrades are complete, operators should avoid binding credentials when the tool is available to agents processing untrusted content. Proxies should be configured via environment variables instead of the tool.
Who needs to act first
Teams should prioritize systems where AI agents interact with external or untrusted web content. Check which environments use the http_request tool with bound credentials. Rotate those tokens immediately to mitigate potential exposure. Test the updated package in a staging environment before deploying to production to ensure agent workflows remain stable. Back up current configurations to allow quick rollback if the new version introduces compatibility issues. Monitor logs for unusual proxy traffic patterns during the transition period to detect any residual anomalies.
What to do and how to stay safe: AWS
- Upgrade strands-agents-tools to version 0.8.2 or later.
- Rotate credentials used in HTTP_REQUEST_TOKEN_CONFIG on affected systems.
- Configure proxies via HTTP_PROXY and HTTPS_PROXY environment variables instead of the tool.
- Avoid using the http_request tool with credentials if agents process untrusted content.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-18394?
It is an incorrect authorization vulnerability in the Strands Agents Tools http_request tool that allows credential disclosure via proxy manipulation.
Which versions are affected?
Versions of strands-agents-tools prior to 0.8.2 are affected by this issue.
Is there a fix available?
Yes, AWS released version 0.8.2 which addresses the authorization bypass.
