Description

Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter. To remediate this issue, users should upgrade to version 0.8.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-06T22:16:55.410Z",
  "pubdate": "2026-08-06T22:16:55.410Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability has been identified in the mongodb_memory, elasticsearch_memory, and mem0_memory tools within Amazon Strands Agents Tools prior to version 0.8.3. This security flaw enables remote authenticated users to bypass multi-tenant isolation boundaries, potentially granting unauthorized access to read, modify, or delete memory stores belonging to other tenants. The vulnerability arises from insufficient server-side validation of tenant-controlled identifiers within tool execution contexts. An attacker possessing remote authentication capabilities can exploit this weakness by leveraging prompt injection techniques to manipulate the Large Language Model (LLM) into generating tool invocations containing forged namespace parameters. Successful exploitation compromises data confidentiality, integrity, and isolation across tenant environments within the affected agent infrastructure. Risk implications include unauthorized data exposure and cross-tenant data tampering. To mitigate these risks, administrators and users must upgrade the affected Amazon Strands Agents Tools package to version 0.8.3 or later, ensuring that namespace validation and access controls are properly enforced during tool execution.",
  "technicalDetails": "The vulnerability is categorized as an Insecure Direct Object Reference (IDOR) flaw residing in specific memory-handling components of Amazon Strands Agents Tools, specifically the mongodb_memory, elasticsearch_memory, and mem0_memory tools. The root cause stems from a lack of robust server-side authorization checks and strict parameter validation regarding the namespace parameter utilized in memory lookup and persistence operations. In multi-tenant architectures, memory tools are expected to isolate user and tenant data dynamically based on authenticated session contexts. However, the affected components inadequately verify whether the invoking entity possesses authorized access to the targeted namespace specified during execution.\nExploitation of this vulnerability requires remote authentication to the agent environment. An attacker achieves unauthorized access by exploiting the underlying LLM agent through crafted inputs or prompt injection payloads. By strategically manipulating the LLM's reasoning and execution loop, the attacker induces the model to emit tool calls containing a forged or arbitrary namespace parameter targeting a different tenant's data space. Because the vulnerable memory tools trust the parameters passed via the LLM-generated tool calls without adequately re-validating them against the authenticated user's access control list (ACL), the backend database operations execute successfully against the unauthorized namespace.\nThe attack flow proceeds as follows: First, the authenticated attacker submits a maliciously crafted prompt to the agent interface designed to override the agent's operating constraints. Second, the LLM processes the prompt and generates a structured tool call destined for one of the vulnerable memory tools (mongodb_memory, elasticsearch_memory, or mem0_memory), injecting a foreign namespace identifier. Third, the application processes the tool call and interacts with the underlying database or storage layer using the forged namespace. Finally, the attacker achieves the post-exploitation impact, which includes reading sensitive information from other tenants, modifying existing memory states, or deleting critical operational records across tenant boundaries. Affected software versions include all builds of Amazon Strands Agents Tools prior to 0.8.3."
}