Strands Agents SSRF CVE-2026-15746 leaks Elasticsearch credentials; rotate keys and update to 0.7.0

AWS disclosed CVE-2026-15746 on July 15, 2026, affecting the Strands Agents open-source Python SDK. The vulnerability exists in the elasticsearch_memory tool within the strands-agents-tools package. This component enables AI agents to store memory using Elasticsearch. The bug is classified as a credential disclosure issue stemming from a server-side request forgery flaw. Environments using this tool to connect to Elasticsearch databases are exposed to the risk of key leakage.

Root cause

The elasticsearch_memory tool exposed its connection parameters as fields that a large language model could control through the tool schema. These parameters included the es_url, cloud_id, and api_key. When a caller did not provide the api_key parameter, the tool defaulted to using the operator's ELASTICSEARCH_API_KEY environment variable. This design allowed the LLM to dictate where the tool sent data.

Attack path

An attacker could craft a prompt that causes the large language model to specify a threat-actor-controlled server as the Elasticsearch endpoint. The tool would then connect to this malicious host. During the connection, it sent the operator's Elasticsearch API key in the Authorization header. This action disclosed the credential to the attacker without requiring direct access to the agent host.

Affected versions

• The vulnerability affects versions of the strands-agents-tools package prior to 0.7.0.
• Any forked or derivative code that has not incorporated the fixes is also vulnerable.
• AWS identifies the scope as important and requiring attention for all users of the SDK.

Mitigation

• Upgrade the strands-agents-tools package to version 0.7.0 or later immediately.
• Rotate the ELASTICSEARCH_API_KEY for all affected environments as a precautionary measure.
• Avoid using the elasticsearch_memory tool until the upgrade is complete and verified.

Signals worth monitoring

Teams usually detect server-side request forgery by monitoring outbound traffic from agent hosts for connections to unknown or suspicious IP addresses. Check whether the elasticsearch_memory tool is initiating connections to endpoints outside the trusted Elasticsearch cluster. Look for authorization headers containing API keys in network logs destined for non-standard hosts. Verify that large language model prompts are not directing tools to arbitrary URLs. Contain the issue by isolating affected agent hosts and restricting their outbound network access to only necessary services.

Background: Server-side request forgery (SSRF)

Developers leave systems open to server-side request forgery by skipping URL validation, allowing internal IP access, and ignoring redirect chains. Each mistake lets attackers pivot from your public web server into private databases, cloud metadata services, or internal admin panels. Fix these gaps by enforcing allowlists and disabling automatic redirects.

Read the full guide: 7 SSRF Mistakes That Expose Internal Networks to Attack

What to do and how to stay safe: AWS

• Update the strands-agents-tools package to version 0.7.0 or newer to apply the security fix.
• Rotate your Elasticsearch API keys immediately, even if you have no evidence of compromise.
• Restrict outbound network access from agent hosts to only trusted Elasticsearch endpoints.
• Audit your codebase for any forked versions of the tool that may lack the patch.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-15746?

It is a credential disclosure vulnerability in the Strands Agents SDK that allows an LLM to send Elasticsearch API keys to attacker-controlled servers.

Which version fixes the issue?

AWS addressed the issue in strands-agents-tools version 0.7.0.

Should I rotate my keys if I am not affected?

AWS recommends all operators rotate their ELASTICSEARCH_API_KEY as a precautionary measure, regardless of exposure indicators.