The strands-agents-tools package includes an elasticsearch_memory tool that allows an LLM to control certain connection parameters, including es_url, cloud_id, and api_key. If the api_key parameter is not provided by the caller, the tool falls back to using the operator's ELASTICSEARCH_API_KEY environment variable. This behavior enables a crafted prompt to cause the tool to send the operator's Elasticsearch API key in the Authorization header to an attacker-controlled host, resulting in a server-side request forgery (SSRF) vulnerability (CWE-918). The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vendor advisory recommends upgrading to version 0.7.0 or later and rotating the API key as a precaution. The vendor advisory URL is https://aws.amazon.com/security/security-bulletins/2026-056-aws/. No explicit remediation level or patch availability is stated in the advisory.

An attacker who can influence the large language model input can exploit this vulnerability to cause the elasticsearch_memory tool to send the operator's Elasticsearch API key to a server controlled by the attacker. This disclosure of sensitive credentials could lead to unauthorized access to Elasticsearch resources. The vulnerability does not require privileges or user interaction beyond the crafted prompt and has a medium severity rating.

The vendor recommends upgrading to strands-agents-tools version 0.7.0 or later to address this vulnerability. Additionally, operators should rotate their ELASTICSEARCH_API_KEY environment variable as a precautionary measure, even if there is no indication that the key has been exposed. Patch status is not explicitly confirmed in the advisory; therefore, check the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-056-aws/ for the latest remediation guidance.