What is CVE-2026-15746?

CVE-2026-15746 is a medium-severity vulnerability in Amazon Strands-agents-tools, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2026-07-15.

How severe is CVE-2026-15746?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SSRF in Amazon Strands-agents-tools

CVE-2026-15746

Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the elasticsearch_memory tool for agent memory storage. We identified…

Vulnerability class: SSRF (Server-Side Request Forgery)

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Amazon Strands-agents-tools — versions 0

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

ff89ba41-3aa1-4d27-914a-91399e9639e5 (release-notes, patch)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (release-notes, patch)

Frequently asked questions

What is CVE-2026-15746?: CVE-2026-15746 is a medium-severity vulnerability in Amazon Strands-agents-tools, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2026-07-15.
How severe is CVE-2026-15746?: Medium severity. CVSS v3 base score is 6.5 out of 10.