AIKIDO-2026-584771

TL;DR

The elasticsearch_memory, mongodb_memory, and mem0_memory tools exposed tenant-identity parameters (namespace, user_id/agent_id) and, for mongodb_memory, the connection string as fields the large language model could set through the tool schema. Because these values determine which tenant's memories are read or written, a crafted prompt could point the tool at another tenant's namespace and read or modify their stored memories, and could redirect the MongoDB connection to disclose its credentials. The values were validated as identifiers but were never bound to a trusted principal. The fix moves tenant identity and connection settings into per-principal tool configuration and environment variables so they are no longer agent-controllable.