CVE-2026-19111

Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter. To remediate this issue, users should upgrade to version 0.8.3.

CVSS 4.0

8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-25)

CWE

CWE-639

Published

2026-08-06

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

References

• https://aws.amazon.com/security/security-bulletins/2026-077-aws/
• https://github.com/strands-agents/tools/security/advisories/GHSA-mpxq-953j-42m4
• https://pypi.org/project/strands-agents-tools/0.8.3/

Check your stackJSON