An authorization bypass vulnerability in Amazon Strands Agents Tools allows authenticated users to access unauthorized objects, necessitating an immediate update to version 0.8.3.

This vulnerability (CWE-639) exists within the mongodb_memory, elasticsearch_memory, and mem0_memory tools. It allows an authenticated user with low privileges to bypass authorization checks, facilitating unauthorized access to objects through user-controlled keys.

With a CVSS score of 8.1, the ability for a low-privileged user to bypass authorization poses a significant risk to data privacy. Successful exploitation could allow internal users to access sensitive data stored in connected memory or storage services, leading to unauthorized information disclosure.

Immediate Action: Update the strands-agents-tools package to version 0.8.3 or higher as recommended by the vendor.

Proactive Monitoring: Review audit logs for unauthorized access attempts to memory-based storage tools, specifically looking for anomalous access patterns by low-privileged service accounts.

Compensating Controls: Enforce strict identity and access management (IAM) policies that limit the ability of low-privileged users to interact with memory-based storage interfaces directly.

Public Exploit Available: Unknown

Security teams should prioritize updating the strands-agents-tools package to version 0.8.3 to remediate this authorization bypass. Given that the vulnerability allows for unauthorized access by authenticated users, ensuring that all instances are patched is critical for maintaining data confidentiality within the environment.