Cross-Tenant Memory Access via Forged Namespace in Strands Agents Memory Tools

Technical Analysis

The affected memory tools accept a namespace parameter to scope memory operations per tenant, but fail to validate that the calling user/session is authorized for the requested namespace, creating a classic IDOR. An attacker can craft prompts or inputs that induce the LLM to emit tool calls with a namespace value belonging to another tenant, since the LLM itself has no inherent enforcement of tenant boundaries and simply passes through attacker-influenced parameters. This crosses the trust boundary between the LLM's natural-language reasoning layer and the underlying data store's access control layer, effectively turning prompt-level influence into a backend authorization bypass. The impact includes unauthorized read, modification, and deletion of persisted agent memories across tenant boundaries, which can lead to data leakage, memory poisoning of other tenants' agents, or denial of service via deletion.

Affected Systems

Amazon Strands Agents Tools

Detection Signatures

• Tool call logs showing memory tool invocations (mongodb_memory, elasticsearch_memory, mem0_memory) with namespace parameters not matching the authenticated user's assigned tenant/session context
• Anomalous namespace values in tool call arguments that appear user-influenced or inconsistent with session metadata
• Repeated tool calls attempting enumeration of namespace values
• Unexpected cross-tenant memory reads/writes/deletes correlated with LLM-generated tool call parameters rather than backend-assigned identifiers

Remediation Steps

1. 1

   Upgrade Strands Agents Tools

   Update to version 0.8.3 or later, which fixes the insecure direct object reference in the affected memory tools.

2. 2

   Enforce server-side namespace validation

   Do not trust LLM-emitted namespace parameters; derive and enforce namespace/tenant scoping from authenticated session context on the backend, independent of tool call arguments.

3. 3

   Audit memory access logs

   Review historical memory tool invocations for cross-tenant namespace access patterns to determine if exploitation occurred.

4. 4

   Apply least-privilege data store credentials

   Ensure mongodb/elasticsearch/mem0 backend credentials used by agent tools are scoped per-tenant where possible to limit blast radius even if namespace validation is bypassed.

5. 5

   Add input sanitization for tool parameters

   Implement allowlist validation of namespace parameters against the caller's known-good tenant identifiers before executing memory operations.