CVE-2026-115415

Vendor

Amazon

Product

strands-agents-tools

CVSS v3.1

6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 16
   AWS bulletin AWS 3d ago

   CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools

   Bulletin ID: 2026-154-AWS Publication Date: 10/28/2026 12:30 PM PDT Description: We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language model (LLM) through its tool…

   CVE-2026-115415 Amazon Web Services
2. 10
   CVE NVD 3d ago

   Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to…

   Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud…

   CVSS 6.5 Fix available CVE-2026-115415 Amazon