This AWS security bulletin, 2026-069-AWS, describes an important vulnerability in the Strands Agents SDK. The strands-agents-tools package, specifically its http_request tool, has an incorrect authorization flaw. This issue, tracked as CVE-2026-18394, could lead to credential disclosure. Operators use HTTP_REQUEST_TOKEN_CONFIG to allowlist hostnames for credential transmission. However, the http_request tool had a proxies parameter in its input schema. A large language model (LLM) could be tricked through a crafted prompt to control this parameter. This allows setting proxies to an actor-controlled endpoint. Despite the hostname allowlist check passing, the credential is still attached to the request. The request is then routed through the actor's proxy on the first hop. Consequently, the credential is disclosed in cleartext within the Authorization header. Affected versions are those earlier than 0.8.2. Users should update to version 0.8.2 or later to mitigate this vulnerability. Further details are available in the linked article, providing comprehensive information.