CVE-2026-19111 - Insecure direct object reference in Strands Agents Tools memory tools

CVE-2026-19111 - Insecure direct object reference in Strands Agents Tools memory tools

Bulletin ID: 2026-077-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/06/2026 11:00 AM PDT

Strands Agents is an open-source SDK for building AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the mongodb_memory, elasticsearch_memory, and mem0_memory tools for storing and retrieving agent memories.

We identified CVE-2026-19111, an insecure direct object reference (IDOR) issue in the mongodb_memory, elasticsearch_memory, and mem0_memory tools. Each tool uses a namespace field as the sole tenant-isolation key, and that namespace was exposed as a parameter the large language model (LLM) could control through the tool schema. A crafted prompt could cause a tool to emit a call with a forged namespace, allowing a remote authenticated user to read, modify, or delete memories belonging to other tenants, or to inject false memories into another tenant's namespace. The standalone mongodb_memory and elasticsearch_memory functions additionally exposed connection parameters, which could allow the memory layer to be redirected to an actor-specified cluster.

This issue has been addressed in strands-agents-tools version 0.8.3. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Until you can upgrade, do not deploy the mongodb_memory, elasticsearch_memory, or mem0_memory tools in multi-tenant agents where end users share a single agent deployment. Restrict these tools to single-tenant deployments in which every request maps to one fixed namespace, and do not use the standalone mongodb_memory or elasticsearch_memory functions that accept connection parameters.