Report · AWS Security BulletinsAbout CVE-2026-19111Published 6 Aug 2026Updated 20 Aug 2026

CVE-2026-19111: Insecure direct object reference in Strands Agents Tools memory tools

Affects strands-agents-toolsSource AWS Security Bulletins

Compare

Authoritative record:CVE-2026-19111· High 8.1

Not known to be exploited · CVSS 8.1 High : upgrade to 0.8.3 soon.

Data as of 5 Nov 2026, 00:01 UTC

CVSS 3.1 base score

8.1High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.5% chance of exploitation in 30 days – higher than 44% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 0.8.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade strands-agents-tools to 0.8.3.

Affected software

Product	Affected	Fixed in
npmstrands-agents-tools`pkg:npm/strands-agents-tools`Other threats	Affected <0.8.3	Fixed in 0.8.3

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

An official fix is available in strands-agents-tools version 0.8.3. It is strongly recommended to upgrade to this version to remediate the vulnerability. Until upgrading, do not deploy the mongodb_memory, elasticsearch_memory, or mem0_memory tools in multi-tenant agent environments where multiple tenants share a single deployment. Restrict these tools to single-tenant deployments with a fixed namespace per request. Avoid using the standalone mongodb_memory or elasticsearch_memory functions that accept connection parameters to prevent redirection attacks.

Description

Bulletin ID: 2026-077-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/06/2026 11:00 AM PDT Description: Strands Agents is an open-source SDK for building AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the mongodb_memory, elasticsearch_memory, and mem0_memory tools for storing and retrieving agent memories. We identified CVE-2026-19111, an insecure direct object reference (IDOR) issue in the mongodb_memory, elasticsearch_memory, and mem0_memory tools. Each tool uses a namespace field as the sole tenant-isolation key, and that namespace was exposed as a parameter the large language model (LLM) could control through the tool schema. A crafted prompt could cause a tool to emit a call with a forged namespace, allowing a remote authenticated user to read, modify, or delete memories belonging to other tenants, or to inject false memories into another tenant's namespace. The standalone mongodb_memory and elasticsearch_memory functions additionally exposed connection parameters, which could allow the memory layer to be redirected to an actor-specified cluster. Impacted versions: < 0.8.3 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Impact

A remote authenticated user can exploit this vulnerability to bypass tenant isolation by forging namespaces, leading to unauthorized reading, modification, deletion, or injection of memories belonging to other tenants. This compromises data confidentiality and integrity within multi-tenant AI agent deployments. Additionally, exposure of connection parameters in standalone tools could allow attackers to redirect memory operations to clusters under their control, potentially enabling further unauthorized access or data manipulation.

Summary

Strands Agents is an open-source SDK for AI agents, with strands-agents-tools providing memory storage tools such as mongodb_memory, elasticsearch_memory, and mem0_memory. CVE-2026-19111 is an IDOR vulnerability where the namespace parameter, used for tenant isolation, is exposed to manipulation by the large language model controlling the tool schema. This flaw enables a remote authenticated user to forge namespaces, thereby reading, modifying, deleting, or injecting memories across tenant boundaries. Moreover, the standalone mongodb_memory and elasticsearch_memory tools expose connection parameters, potentially allowing redirection of memory operations to attacker-specified clusters. The vulnerability affects all versions before 0.8.3. The vendor has released version 0.8.3 to address this issue and recommends upgrading. Workarounds include avoiding deployment of these tools in multi-tenant environments or restricting to single-tenant setups with fixed namespaces and avoiding standalone functions that accept connection parameters.

References

aws.amazon.com/security/security-bulletins/rss/2026-077-aws/ (opens in a new tab)

Community reviews

Loading reviews…