Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115415— Secret masking bypass in the environment tool in Strands Agents Tools

Quick assessment

Affected
amazon strands-agents-tools
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Strands Agents Tools 0.8.6 版本之前，环境工具（environment tool）中用于大语言模型（LLM）提示的输入未能得到正确净化，这可能导致远程攻击者通过构造特定提示来禁用该工具的敏感信息屏蔽机制，从而以明文形式获取代理宿主机的环境变量，其中包括云凭证和 API 密钥。 为修复此问题，用户应升级至 0.8.6 或更高版本，并对任何曾存在于加载了环境工具的代理环境中的凭证进行轮换。

CVSS 6.5 · Medium EPSS 0.34% · P28

Affected Version Matrix 1

VendorProduct Version RangeStatus
amazon strands-agents-tools 0.1.0< 0.8.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115415

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Secret masking bypass in the environment tool in Strands Agents Tools
Source: CVE Program / CVE List V5
Vulnerability Description
Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking. To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1427
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
amazon strands-agents-tools 0.1.0 ~ 0.8.6 -

II. Public POCs for CVE-2026-115415

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115415

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-115415 (2)

Vendor Pages for CVE-2026-115415 (1)

IV. Related Vulnerabilities

Same product: strands-agents-tools
Same vendor: amazon
Same weakness: CWE-1427