Strands Agents elasticsearch_memory Tool SSRF and API Key Exfiltration
First seen Jul 16, 2026 · Updated Jul 16, 2026 · CVSS 6.5
The elasticsearch_memory tool in strands-agents-tools exposed connection parameters like the target host directly to LLM control, allowing a crafted prompt to redirect the tool to an attacker-controlled server. When the api_key parameter was omitted, the tool silently fell back to the operator's environment-stored Elasticsearch API key and sent it to whatever host the LLM specified, leaking the credential via the Authorization header. This is a classic tool-schema over-permissioning issue that turns an LLM-controllable field into a credential exfiltration vector.
Technical Analysis
The tool schema allowed the LLM to set es_url/cloud_id at call time while the tool independently injected a privileged secret (ELASTICSEARCH_API_KEY) from the environment when the caller did not supply one. An attacker who can influence the agent's prompt (directly or via injected content in retrieved documents, tool outputs, or memory) can instruct the LLM to invoke the memory tool with an attacker-controlled es_url, causing the tool to send the operator's real API key to that endpoint in an HTTP Authorization header. This crosses the trust boundary between untrusted LLM-controlled parameters and privileged operator secrets, effectively letting prompt-level influence trigger server-side credential disclosure. The entry point is any surface that can shape agent input (user prompt, RAG content, tool responses), and the impact is full compromise of the Elasticsearch API key, enabling downstream access to the memory backend or other Elasticsearch-hosted data.
Affected Systems
Strands Agents, strands-agents-tools
Detection Signatures
- Outbound HTTP requests from agent host to unexpected/non-allowlisted Elasticsearch or cloud_id hosts
- Authorization header present in requests to unfamiliar external domains following LLM-driven tool calls
- Tool invocation logs showing es_url or cloud_id values differing from operator-configured defaults
- Absence of api_key parameter in tool call combined with outbound request to non-standard host
- Alerts on strands-agents-tools versions < 0.7.0 in dependency manifests
Remediation Steps
- 1
Upgrade strands-agents-tools
Update to strands-agents-tools version 0.7.0 or later, which removes LLM control over sensitive connection parameters or properly scopes credential fallback behavior.
- 2
Rotate Elasticsearch API keys
Rotate ELASTICSEARCH_API_KEY for all operators using the affected tool, regardless of confirmed exposure, since the credential could have been silently exfiltrated.
- 3
Restrict tool schema parameters
Do not expose infrastructure connection parameters (host, cloud_id, credentials) as LLM-controllable fields; enforce them via server-side configuration only, with allowlisted destinations.
- 4
Enforce egress allowlisting
Restrict outbound network connections from agent/tool execution environments to a known allowlist of Elasticsearch endpoints to prevent SSRF-style redirection.
- 5
Audit tool call logs
Review historical tool invocation logs for anomalous es_url/cloud_id values indicating prior exploitation attempts.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.