CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools
// AI summary
Strands Agents Tools has CVE-2026-115415, a secret masking bypass where a crafted prompt can instruct the LLM to call the environment tool with masking turned off.
// from the source
Bulletin ID: 2026-154-AWS Publication Date: 10/28/2026 12:30 PM PDT Description: We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language model (LLM) through its tool schema. A crafted prompt, delivered through content the agent is asked to process, could instruct the model to call the tool with masking turned off. The tool would then return the agent host's environment variables in cleartext, including cloud credentials and API keys