Amazon Strands Agents Tools Has an IDOR Bug in Its Memory Layer

If your agents remember anything—chat history, user profiles, embedded context—and you built that memory layer with Amazon’s Strands Agents Tools, check the version number today.

The bug is CVE-2026-19111, and the NVD record is precise about where it lives: an insecure direct object reference sitting inside three specific tools, mongodb_memory, elasticsearch_memory, and mem0_memory. It touches every release of Strands Agents Tools before version 0.8.3.

That’s the whole vulnerability class in three words: insecure direct object reference. A memory record — a stored conversation, a user profile, an embedding — gets an identifier. The tool is supposed to check that the caller requesting that identifier actually owns it. IDOR means that check is missing or broken somewhere in the request path. Anyone who can reach or guess an object ID can potentially pull or touch a record that belongs to someone else, without ever needing valid credentials for that record.

The people who need to move on this are narrow but specific: teams running agents on Amazon’s Strands framework who chose MongoDB, Elasticsearch, or Mem0 as the memory backend behind those agents, and who haven’t updated past 0.8.3. If that’s your stack, the exposure isn’t abstract — it’s whatever your agents have been storing in that memory layer since you deployed them. Session history. User identifiers. Anything an agent decided was worth remembering long-term.

What changes practically: upgrading to 0.8.3 closes the specific IDOR path in those three tools. The upgrade alone doesn’t tell you what, if anything, was already accessed while the flaw was live — that requires checking your own logs for memory-tool calls that don’t line up with the session or user that should have made them. Agent memory is a new enough pattern that most teams haven’t built that audit habit yet, and this CVE is the reason to build it now rather than after an incident forces the question.

It’s also a reminder that the fastest-growing attack surface in AI right now isn’t the model. It’s everything wired around it — the tools, the memory stores, the object references nobody stress-tested because the framework shipped fast. If you’re building agentic systems and haven’t pressure-tested what your guardrails actually catch, the Forge guardrails breakdown is worth the read, and the full agentic stack piece covers where memory and orchestration tend to break first.

Patch to 0.8.3, audit your memory-tool logs, and get the next one in your inbox before it lands — subscribe at /subscribe/.