AWS Strands Agents exposed the tenant-isolation key to the model: CVE-2026-19111 lets a prompt forge another tenant's memory namespace

AWS Security Bulletins·high signalXBlueskyLinkedInCopy link

AWS security bulletin 2026-077-AWS (August 6) discloses an IDOR in strands-agents-tools where `mongodb_memory`, `elasticsearch_memory` and `mem0_memory` used a `namespace` field as the sole tenant-isolation key — and exposed that field as an LLM-controllable tool-schema parameter. A crafted prompt could emit a call with a forged namespace to read, modify, delete or poison another tenant's memories, and the standalone mongodb/elasticsearch functions additionally exposed connection parameters so the memory layer could be redirected to an attacker-specified cluster. Fixed in 0.8.3; the design lesson is that any security boundary rendered into a tool schema is a boundary the model can rewrite.