AIKIDO-2026-382117

TL;DR

The elasticsearch_memory tool exposes its Elasticsearch connection parameters (es_url, cloud_id, api_key) as fields the language model can control through the tool schema. When a caller omits api_key, the tool falls back to the operator's ELASTICSEARCH_API_KEY environment variable, and because the destination host is also model-controllable, a crafted prompt can direct the tool to connect to an actor-controlled server. In that case the operator's Elasticsearch credential is sent in the Authorization header to the attacker host, disclosing it. The fix restricts the connection parameters so the model can no longer redirect requests to leak the stored credential.