Quick answers
- Is CVE-2026-15746 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-15746 being exploited in the wild.
- How severe is CVE-2026-15746?
- High severity, with a CVSS score of 6.5, published 15 July 2026.
- Which products and versions are affected?
- Amazon Strands-Agents-Tools < 0.7.0; Amazon Web Services Agents Tools <UNKNOWN>.
- Is there a fix for CVE-2026-15746?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-15746 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-15746?
- Check whether you run Amazon AWS, Amazon Strands-Agents-Tools or Amazon Web Services Agents Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-15746 is a credential disclosure vulnerability in the elasticsearch_memory tool provided by Strands Agents Tools. The vulnerability allows sensitive Elasticsearch authentication credentials to be improperly exposed, potentially through log files, error messages, memory dumps, or insecure credential handling within the tool. This is a client-side vulnerability affecting the tool's credential management. An attacker with access to exposed credentials can authenticate directly to Elasticsearch clusters, bypassing application-level access controls. The vulnerability requires no special network positioning or user interaction beyond deploying the affected tool. As of the publication date, AWS has issued a security bulletin recommending users review their credential exposure and rotate affected Elasticsearch credentials.
Affected products
- AWS Strands Agents Tools <UNKNOWN>
Timeline
- 2026-09-22: disclosed