Agent-framework CVEs, 10-21 to 10-23: mem0 SQL injection (9.2), AgenticSeek debug server (9.2), req_llm no TLS (9.1), Strands A2A, SAM CLI, Hermes, Goose history

View raw markdownEdit on GitHub ↗

TL;DR

Seven agent-framework records from 10-21 to 10-23, three Critical. mem0ai (CVE-2026-115324 / GHSA-7587-9684-52r6, 9.2): memory text, metadata or message names reaching unescaped queries in the Databricks vector store let an attacker run SQL on the configured warehouse; 0.1.117 before 1.0.8, fixed 1.0.8 (PR #4558). AgenticSeek (CVE-2026-115727 / GHSA-r5cp-9ffr-m5mf, 9.2): llm_server/app.py ran Flask with debug on and bound every interface, so anyone reaching the port who derives the Werkzeug PIN runs commands as the server process; fixed at commit 409840c (PR #558). req_llm (CVE-2026-107685 / GHSA-w53j-6pxf-r2vw, 9.1): the WebSocket streaming client skipped certificate verification and dropped caller TLS options, exposing OpenAI sessions and bearer tokens on-path; 1.9.0 before 1.29.0. Strands Agents SDK (CVE-2026-115419 / GHSA-4v6f-7vjh-6x4m, 8.6, AWS bulletin 2026-146): the A2A server shared conversation history across callers with different context_ids; fixed strands-agents 1.43.0 and @strands-agents/sdk 1.5.0. AWS SAM CLI (CVE-2026-115414, bulletin 2026-145): the Terraform hook's generated Makefile inserted a resource address without neutralising shell metacharacters, so a Terraform config or plan file runs commands as the build user; 1.63.0 through 1.166.1, fixed 1.166.2. Hermes Agent (CVE-2026-114463, CERT/CC): the webhook gateway derived the authorizing route by splitting a string a route name with a colon can shape, so a caller holding one route's HMAC gains a higher-privileged route's toolsets; through 2026.8.19, fix PR #115285 / v0.22.2. Goose (CVE-2026-111079 / GHSA-4537-c6fq-qchm, 7.4, Red Hat CNA): with terminal integration on, shell history is sent verbatim to the configured LLM provider, so tokens typed at the prompt leave the machine; no fixed version on the record.

What happened

  • mem0ai. GitHub Advisory Database 2026-10-22, reviewed 10-23, CVSS 4.0 9.2 (AC:H/AT:P), references issue #4073, PR #4558, commit a2ffca3, release v1.0.8, VulnCheck. mem0 was filed here before for memory poisoning; this is the storage layer itself.
  • AgenticSeek. Published 2026-10-23, CVSS 4.0 9.2, no package or range in structured fields; references PR #558, commit 409840c, the pre-fix app.py lines, VulnCheck.
  • req_llm (agentjido). Published 2026-10-23, CVSS 4.0 9.1; structured fields "Unknown", description gives 1.9.0 up to 1.29.0; it is an Elixir LLM client used by the Jido agent framework.
  • Strands. NVD 2026-10-22, database 10-23, CWE-488; PRs #2628 and #2696, commits 398343f, 403d878, f8ba937; registry 2026-10-26: strands-agents version list not returned in this session, @strands-agents/sdk not checked. Home for Strands' earlier bugs: AgentCore cluster.
  • SAM CLI. Bulletin dated 2026-10-22; credit Shubham Raj (Cipher by Causal Security); mitigation until upgrade: only trusted Terraform inputs, audit third-party modules.
  • Hermes Agent. CERT/CC record published 2026-10-21 15:01 UTC, CWE-863, no CVSS, affected 0 through 2026.8.19 ("custom" version type); references the fix PR, release v0.22.2 and the reporter's advisory repository (pinarsadioglu). Earlier Hermes entries in this corpus concern campaigns using it, not the framework (Carbonato).
  • Goose. Published 2026-10-22, CVSS 3.1 7.4 (UI:R, scope changed), CWE-497, references Red Hat bugzilla 2554025; Goose appeared here in GuardFall and GitSpawn.

Why it is here: four of these are the default-exposure class (a debug server on all interfaces, a client that never verified TLS, a build hook that trusts a config file, a gateway that trusts a string it built), and two leak what a coding agent's host holds (shell history to the provider, another tenant's conversation).

Am I affected?

  • pip show mem0ai strands-agents aws-sam-cli and npm ls @strands-agents/sdk; mix deps | grep req_llm; sam --version.
  • AgenticSeek: any checkout older than 409840c with llm_server running; ss -ltnp for the port on 0.0.0.0.
  • Hermes: a webhook route whose name contains :, or any deployment on or before 2026.8.19 with more than one route and differing toolsets.
  • Goose: terminal integration enabled; assume anything typed into that shell reached the provider's logs.

If you are affected

  1. Upgrade: mem0ai 1.0.8, strands-agents 1.43.0 / @strands-agents/sdk 1.5.0, SAM CLI 1.166.2, req_llm 1.29.0, Hermes v0.22.2, AgenticSeek past 409840c.
  2. Goose: disable terminal integration until a fix is published and rotate any token typed at that shell. Credential hygiene.
  3. SAM CLI users who built from third-party Terraform: treat the build host's credentials as exposed, rotating cloud credentials.
  4. Strands A2A operators: review whether another caller's history reached a tenant; rotate the session secrets involved.

Prevention

  • Agent sandboxing: loopback and auth on every helper server; build hooks run in a container without long-lived keys.
  • Supply chain attack surface: a Terraform module or plan file is build input, the same as a package.

Two strands-agents advisories vendor-published on 2026-10-05 reached the database on 2026-10-27, neither with a CVE. GHSA-3w55-933p-8pv5 — Local Privilege Escalation via Symlink Attack in Default Session File Storage (High, CVSS 3.1 7.1, CWE-59, reporter manus-use): FileSessionManager defaults to /tmp/strands/sessions/, a world-writable directory with predictable paths, and its write routine writes a predictable .tmp file then renames it with open() following symlinks, so a local user who pre-places a symlink redirects the agent's write to a file of their choosing; the advisory names two outcomes, overwriting files such as shell configuration or SSH keys, and editing session files to inject instructions into an agent's conversation history, which carry no integrity check. GHSA-763v-5pjm-fx36 — Default FileSessionManager storage is world-readable on shared systems (Moderate, CVSS 4.0 5.7, CWE-276, reporter whyiug): the same directory takes the process umask, so with umask 022 session directories are 0755 and the JSON session files 0644, and session data (prompts, model outputs, tool inputs and outputs, secrets) is readable by every local user. Both affected below 1.48.0 and fixed in 1.48.0, which PyPI dates to 2026-07-17, eleven weeks before the advisories and fourteen before the database rows; strands-agents is 1.62.0 as of 2026-10-28, so a current install is past both. The relevance is shared hosts: a CI runner, a dev box, a notebook server where more than one user runs agents. Set storage_dir to a private path on any version, and read the session file as something another local user may have edited.

Update 2026-10-29 — a second mem0 bug, cross-tenant memory through unescaped scope delimiters (CVE-2026-116575, 6.3; fixed 2026-08-11), and Strands Agents Tools' environment tool let the model turn off secret masking (CVE-2026-115415, 6.5; fixed 0.8.6 on 2026-08-07)

mem0. GHSA-5324-3w58-qpp2 / CVE-2026-116575 (GitHub as CNA, published 2026-10-26, modified 10-27; CVSS 3.1 6.3 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N): _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id and run_id with unescaped & and =, so a caller can embed another scope component in an identifier and make two tenant tuples produce one session_scope key; Memory.add(), AsyncMemory.add() and POST /memories then read and save recent raw messages under that key, disclosing another tenant's conversation or evicting and interleaving its history. Fixed in Python SDK 2.0.18 (PyPI 2026-08-11) and TypeScript SDK 3.1.6 (npm 2026-08-11), PR #6892, commit 71f2ebe; the advisory came 76 days after the fix. Registry newest when read: mem0ai 2.2.1 (PyPI), 3.3.1 (npm). This is a different bug from the Databricks SQL injection above (CVE-2026-115324, fixed 1.0.8); a deployment on 1.0.8 through 2.0.17 has this one.

Strands Agents Tools. GHSA-qjx4-hg6g-2f34 / CVE-2026-115415 (AWS as CNA, bulletin 2026-154-AWS, published 2026-10-28; CVSS 3.1 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, CVSS 4.0 5.9, CWE-522 and CWE-1427): the environment tool in strands-agents-tools masked secret-like variable values by default, but the masking parameter sat in the tool's input schema, so the model could set it off, and the list and get actions needed no operator confirmation; an attacker who can place instructions in content the agent processes gets the host's environment variables in cleartext, cloud credentials and API keys included, and can pass them on through another tool. Affected 0.1.0 before 0.8.6; in 0.8.6 (PyPI 2026-08-07, 82 days before the advisory) only the operator controls masking and the tool is deprecated. AWS says to upgrade and rotate any credentials that were present in the environment of agents that loaded the tool. Newest 0.8.10. Check: pip show strands-agents-tools below 0.8.6 with the environment tool loaded.

Sources for this update: CVE Services — CVE-2026-116575 — fetched 2026-10-29: the description, the fixed versions, the vector, the PR, commit and release references. strands-agents/tools — GHSA-qjx4-hg6g-2f34 — fetched 2026-10-29: published 2026-10-28, Moderate 6.5, the masking-parameter mechanism, affected and patched versions, the deprecation, the workarounds. CVE Services — CVE-2026-115415 — fetched 2026-10-29: CNA AMZN, the rotation instruction, the bulletin reference. AWS Security Bulletins index — fetched 2026-10-29: 2026-154-AWS dated 2026-10-28 beside 2026-153 (AWS SDK for pandas) and 2026-155 (Brotli). PyPI release history read 2026-10-29: mem0ai 2.0.18 2026-08-11; strands-agents-tools 0.8.5 2026-07-21, 0.8.6 2026-08-07. npm time for mem0ai: 3.1.6 2026-08-11.

Sources