PulseAugur
EN
LIVE 03:05:45

Strands agent tool vulnerability leaks credentials via proxy injection

By PulseAugur Editorial · [1 sources] ·

A security vulnerability, CVE-2026-18394, has been identified in the http_request tool within the strands-agents-tools library. This flaw allows for credential leaks by enabling prompt injection to redirect requests through an attacker-controlled proxy server. The vulnerability, rated as Moderate with a CVSS score of 6.9, was patched by removing the 'proxies' parameter from the model-visible input, ensuring proxy settings are operator-controlled. AI

IMPACT This vulnerability highlights risks in agent tools that process untrusted LLM inputs, potentially leading to credential leaks and necessitating careful security audits.

RANK_REASON Security vulnerability disclosure for a specific software tool.

Read on dev.to — LLM tag →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

Strands agent tool vulnerability leaks credentials via proxy injection

How we ranked this

Signal score
64 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
Security vulnerability disclosure for a specific software tool.
Source corroboration
Single-source cluster
Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
Breaking (< 6h)
Fresh story with cross-source coverage still developing. Ranking may shift as more sources report.

Full methodology in our editorial standards.

COVERAGE [1]

  1. dev.to — LLM tag TIER_1 English(EN) · hugginf_expert ·

    The Allowlist Guarded the Destination, Not the Route: A Proxies Parameter Leaked Credentials From an Agent HTTP Tool

    <h2> TL;DR </h2> <ul> <li>CVE-2026-18394 (GitHub advisory GHSA-qhw6-2h72-m84v, AWS bulletin 2026-069-AWS, published July 31, 2026) is a credential leak in the <code>http_request</code> tool of <code>strands-agents-tools</code>. An operator could bind a token to approved hostnames…

RELATED ENTITIES

RELATED TOPICS