CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools
Bulletin ID: 2026-154-AWS Publication Date: 10/28/2026 12:30 PM PDT Description: We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language model (LLM) through its tool schema. A crafted prompt, delivered through content the agent is asked to process, could instruct the model to call the tool with masking turned off. The tool would then return the agent host's environment variables in cleartext, including cloud credentials and API keys, without prompting the operator for consent. Impacted versions: >= 0.1.0 AND Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services
Why it ranks 16 (Routine)
- Covered by 2 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-115415 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.