Live › vulnerability › CVE-2026-115415
Go to dashboardThe environment tool in strands-agents-tools let the LLM turn off secret masking through its tool schema. A crafted prompt in content the agent processes can make it return the agent host's environment variables in cleartext, including cloud credentials and API keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 20:07 UTC, 0h before NVD. All times on this page are UTC.
Teams running agents built on the Strands Agents SDK that load the environment tool from strands-agents-tools. The risk is highest where agents process untrusted content and the host process holds long-lived cloud credentials or API keys in its environment. Agents that do not load the environment tool, or that run on versions 0.8.6 and later, are not affected.
No product ranges from the sources yet.
pip show strands-agents-tools and look for versions at or above 0.1.0 and below 0.8.6.environment in the tools list.strands-agents-tools to 0.8.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools
Bulletin ID: 2026-154-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 12:30 PM PDT
Description:
Strands Agents Tools (strands-agents-tools) is an open-source Python package of pre-built tools for the Strands Agents SDK. The environment tool lets an agent list, read, set, and delete environment variables on the agent host, and masks values that look like secrets by default. We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language model (LLM) through its tool schema. A crafted prompt, delivered through content the agent is asked to process, could instruct the model to call the tool with masking turned off. The tool would then return the agent host's environment variables in cleartext, including cloud credentials and API keys, without prompting the operator for consent.
Impacted versions: >= 0.1.0 AND < 0.8.6
Resolution:
This issue has been addressed in strands-agents-tools version 0.8.6. Masking is now controlled only by the operator, and the model can no longer disable it. The environment tool is also deprecated as of this release. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. We also recommend rotating any credentials that were present in the environment of agents that loaded the environment tool.
Workarounds:
If you cannot upgrade right away, remove the environment tool from your agents. Avoid running agents with long-lived cloud credentials or API keys in the process environment, and restrict outbound network access from the agent host to trusted endpoints only.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-115415")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.