CVE-2026-18394

CVE-2026-18394 is a trust boundary failure in the Strands Agents Tools http_request component. The tool allows an LLM to control proxy routing through the HTTP_REQUEST_TOKEN_CONFIG mechanism, but this creates an exploitable gap: credentials are scoped to destinations the operator intends, while routing authority is delegated to the LLM with no runtime enforcement tying those two decisions together. The immediate risk is credential exfiltration — if an attacker influences which proxy the LLM routes through, they can intercept the HTTP_REQUEST_TOKEN_CONFIG and any authenticated traffic. But the more severe exposure is the reasoning loop compromise. An attacker-controlled proxy can serve modified responses that alter the LLM's context, giving them persistent, low-and-slow influence over every subsequent agent decision. This elevates the vulnerability from a one-shot data breach to ongoing decision manipulation. To defend against this: upgrade to 0.8.2 immediately. However, verify what the upgrade actually enforces — the fix should pin destination scope at the implementation layer, not merely validate that LLM-submitted routing parameters look reasonable. If the fix is only input gating, the underlying transitive trust problem remains. Assume that any deployment running versions prior to 0.8.2 with HTTP_REQUEST_TOKEN_CONFIG in use has had routing traffic potentially observable by an attacker, and rotate those tokens as a precaution. Be aware that this vulnerability may interact with prompt injection attacks that don't directly target http_request but manipulate the LLM's broader context to shift routing preferences. If your agentic workflow processes untrusted inputs, treat LLM-mediated routing as a distinct threat model requiring explicit containment — don't assume that because the tool is patched, the lateral path through context manipulation is closed.

Reviewed through automated stages and approved by a human before publication.