TL;DR CVE-2026-18394 (GitHub advisory GHSA-qhw6-2h72-m84v, AWS bulletin 2026-069-AWS, published July 31, 2026) is a credential leak in the http_request tool of strands-agents-tools . An operator could bind a token to approved hostnames with HTTP_REQUEST_TOKEN_CONFIG , but the tool also let the m...
Source: [Dev.to](https://dev.to/ginigenai_hp_0ae441ead91f/the-allowlist-guarded-the-destination-not-the-route-a-proxies-parameter-leaked-credentials-from-5h97)