To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| amazon | strands-agents-tools | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 28 Oct 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking. To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool. | |
| Title | Secret masking bypass in the environment tool in Strands Agents Tools | |
| First Time appeared |
Amazon
Amazon strands-agents-tools |
|
| Weaknesses | CWE-1427 | |
| CPEs | cpe:2.3:a:amazon:strands-agents-tools:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Amazon
Amazon strands-agents-tools |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: AMZN
Published:
Updated: 2026-10-28T19:37:36.733Z
Reserved: 2026-10-22T13:11:05.160Z
Link: CVE-2026-115415
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.