Strands Agents Tools includes an elasticsearch_memory tool that stores agent memory in Elasticsearch. The tool accepts connection parameters (es_url, cloud_id, api_key) from the LLM through its schema. If the api_key parameter is omitted, the tool falls back to the operator’s ELASTICSEARCH_API_KEY environment variable and transmits that key in the Authorization header to whatever host the LLM supplies. This server‑side request forgery permits a malicious LLM prompt to direct the tool to an attacker‑controlled server, resulting in credential disclosure of the Elasticsearch API key, which enables an attacker to access the target Elasticsearch cluster and any data it contains.

Amazon Strands Agents Tools is the impacted product. Any installation using the elasticsearch_memory component in the strands‑agents‑tools Python SDK before version 0.7.0 is vulnerable, as the fix was introduced in that release. The vulnerability affects deployments where the tool’s connection parameters are exposed to the LLM and the ELASTICSEARCH_API_KEY environment variable is set.

CVSS score 6.9 indicates a moderate severity flaw. The EPSS score of less than 1% points to a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an LLM that can control the tool’s schema and a functioning installation of the vulnerable tool with the ELASTICSEARCH_API_KEY environment variable set. By sending a malicious es_url in the prompt, an attacker can make the tool send the API key to a server they control, thereby obtaining the credentials.