Strands Agents Tools <0.8.6: Improper Input Neutralization (env disclosure)
CVE-2026-115415 Published on October 28, 2026
Secret masking bypass in the environment tool in Strands Agents Tools
Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking.
To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.
Vulnerability Analysis
CVE-2026-115415 can be exploited with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Products Associated with CVE-2026-115415
stack.watch emails you whenever new vulnerabilities are published in Amazon Aws or Amazon Strands Agents Tools. Just hit a watch button to start following.
Affected Versions
amazon strands-agents-tools:- Version 0.1.0 and below 0.8.6 is affected.