What happened
AWS disclosed (security bulletin 2026-077-AWS) and NVD published CVE-2026-19111 (CVSS 8.1, High) on August 6, 2026: an IDOR vulnerability in three memory-backend tools bundled with Amazon's Strands Agents framework lets an attacker manipulate the LLM into emitting tool calls that cross tenant boundaries in persistent agent memory.
Why it matters
Agent memory stores are increasingly used to persist user context and history across sessions in multi-tenant SaaS AI products; a cross-tenant IDOR in the memory layer means one customer's conversational history, PII, or business data can be read or tampered with by another tenant simply by steering the LLM's own tool-call arguments — a prompt-injection-adjacent authorization bypass in widely-used AWS agent tooling.
Attack vector
Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools allows a remote authenticated user to access, modify, or delete memories belonging to other tenants by influencing the LLM via prompt manipulation to emit tool calls with a forged tenant/memory identifier.
Affected systems
Amazon Strands Agents Tools < 0.8.3
Mitigation
Upgrade to Amazon Strands Agents Tools 0.8.3 or later per AWS security bulletin 2026-077-AWS.