{"id":"GHSA-qjx4-hg6g-2f34","kind":"vulnerability","aliases":["GHSA-qjx4-hg6g-2f34"],"related":[],"title":"CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools","description":"CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools\n\n### CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools\n\nBulletin ID: 2026-154-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 12:30 PM PDT\n\nDescription:\n\nStrands Agents Tools (strands-agents-tools) is an open-source Python package of pre-built tools for the Strands Agents SDK. The environment tool lets an agent list, read, set, and delete environment variables on the agent host, and masks values that look like secrets by default. We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language model (LLM) through its tool schema. A crafted prompt, delivered through content the agent is asked to process, could instruct the model to call the tool with masking turned off. The tool would then return the agent host's environment variables in cleartext, including cloud credentials and API keys, without prompting the operator for consent.\n\nImpacted versions: >= 0.1.0 AND < 0.8.6\n\nResolution:\n\nThis issue has been addressed in strands-agents-tools version 0.8.6. Masking is now controlled only by the operator, and the model can no longer disable it. The environment tool is also deprecated as of this release. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. We also recommend rotating any credentials that were present in the environment of agents that loaded the environment tool.\n\nWorkarounds:\n\nIf you cannot upgrade right away, remove the environment tool from your agents. Avoid running agents with long-lived cloud credentials or API keys in the process environment, and restrict outbound network access from the agent host to trusted endpoints only.\n\nReferences:\n\n- CVE-2026-115415\n- GHSA-qjx4-hg6g-2f34\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The environment tool in strands-agents-tools let the LLM turn off secret masking through its tool schema. A crafted prompt in content the agent processes can make the agent return all host environment variables in cleartext, including cloud credentials and API keys.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","aws","lab-disclosure","python","self-hosted","strands-agents"],"not_affected_if":["environment-tool-not-loaded","no-long-lived-credentials-in-env","version-0.8.6-or-later"],"how_to_check":"- Check the installed version with `pip show strands-agents-tools` and look for versions >= 0.1.0 and < 0.8.6.\n- Check whether agents load the environment tool, for example by searching agent code for `environment` in the tools list.","fix":"- Upgrade strands-agents-tools to `0.8.6` or later.\n- Remove the environment tool from agents if you cannot upgrade now; the release also deprecates it.\n- Rotate any cloud credentials and API keys that were present in the environment of agents that loaded the environment tool.\n- Patch any forked or derivative code.","status":"open","published_at":"2026-10-28T00:00:00+00:00","first_seen_at":"2026-10-28T20:07:44+00:00","triaged_at":"2026-10-28T20:09:05+00:00","updated_at":"2026-10-28T20:09:05+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-28T20:09:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade strands-agents-tools to `0.8.6` or later.\n- Remove the environment tool from agents if you cannot upgrade now; the release also deprecates it.\n- Rotate any cloud credentials and API keys that were present in the environment of agents that loaded the environment tool.\n- Patch any forked or derivative code.","reach":"internet","title":"Strands Agents Tools: prompt injection disables secret masking, leaking environment variables","impact":"high","summary":"The environment tool in strands-agents-tools let the LLM turn off secret masking through its tool schema. A crafted prompt in content the agent processes can make the agent return all host environment variables in cleartext, including cloud credentials and API keys.","category":"ai-tooling","nicknames":[],"who_cares":["strands-agents","python","ai-agents","aws","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads host environment variables, including cloud credentials and API keys","analyst_note":"","how_to_check":"- Check the installed version with `pip show strands-agents-tools` and look for versions >= 0.1.0 and < 0.8.6.\n- Check whether agents load the environment tool, for example by searching agent code for `environment` in the tools list.","needs_analyst":false,"not_affected_if":["version-0.8.6-or-later","environment-tool-not-loaded","no-long-lived-credentials-in-env"],"who_is_affected":"Teams running agents built on the Strands Agents SDK that load the strands-agents-tools environment tool, where the agent processes untrusted content such as web pages, documents or emails. Agents without the environment tool, or on version 0.8.6 or later, are not affected. Exposure is highest when the agent host holds long-lived cloud credentials or API keys in its process environment.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":3951,"output_tokens":661,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115415':3A,88C,102C,188C,388C '-154':117C '-2026':2A,87C,101C,187C,387C '0.1.0':260C '0.8.6':262C,275C '10/28/2026':128C '12':129C '2026':116C '2f34':19A,24A,393C '30':130C 'accept':195C 'access':376C 'address':268C 'agent':13A,27B,41B,48B,67B,72B,98C,112C,135C,139C,156C,163C,173C,216C,239C,272C,336C,355C,358C,379C 'ai':26B,29B 'ai-ag':25B 'ai-tool':28B 'also':296C,324C 'api':84B,250C,366C 'ask':218C 'attent':125C 'avoid':356C 'aw':31B,118C,120C 'away':348C 'aws-security@amazon.com':396C 'built':151C 'bulletin':114C 'bypass':6A,91C,105C 'call':226C 'cannot':345C 'cleartext':79B,245C 'cloud':81B,247C,363C 'code':315C 'concern':402C 'consent':257C 'content':65B,121C,214C 'control':279C 'could':221C 'craft':62B,210C 'credenti':82B,248C,328C,364C 'cve':1A,86C,100C,186C,386C 'date':127C 'default':183C 'delet':168C 'deliv':212C 'deprec':297C 'deriv':314C 'descript':133C 'disabl':290C 'disclosur':34B 'email':395C 'endpoint':383C 'ensur':310C 'environ':9A,43B,76B,94C,108C,159C,169C,193C,242C,293C,334C,340C,351C,371C 'fix':322C 'fork':312C 'ghsa':16A,21A,390C 'ghsa-qjx4-hg6g-2f34':15A,20A,389C 'hg6g':18A,23A,392C 'host':38B,75B,174C,240C,380C 'id':115C 'identifi':185C 'impact':258C 'import':123C 'includ':80B,246C 'incorpor':319C 'instruct':222C 'issu':190C,265C 'key':85B,251C,367C 'lab':33B 'lab-disclosur':32B 'languag':202C 'larg':201C 'latest':307C 'let':50B,161C 'like':180C 'list':164C 'live':362C 'llm':52B,204C 'load':338C 'long':361C 'long-liv':360C 'longer':289C 'look':179C 'make':70B 'mask':5A,56B,90C,104C,176C,197C,230C,276C 'model':203C,224C,286C 'network':375C 'new':321C 'open':144C 'open-sourc':143C 'oper':255C,283C 'outbound':374C 'packag':147C 'paramet':198C 'patch':317C 'pdt':132C 'pleas':394C 'pm':131C 'pre':150C 'pre-built':149C 'present':331C 'process':68B,220C,370C 'prompt':63B,211C,253C 'public':126C 'python':35B,146C 'qjx4':17A,22A,391C 'question':400C 'read':165C 'recommend':303C,325C 'refer':385C 'releas':301C 'remov':349C 'requir':124C 'resolut':263C 'restrict':373C 'return':73B,237C 'right':347C 'rotat':326C 'run':357C 'schema':60B,208C 'scope':119C 'sdk':157C 'secret':4A,55B,89C,103C,181C 'secur':399C 'self':37B 'self-host':36B 'set':166C 'sourc':145C 'strand':12A,40B,47B,97C,111C,134C,138C,155C,271C 'strands-ag':39B 'strands-agents-tool':46B,137C,270C 'tool':10A,14A,30B,44B,49B,59B,95C,99C,109C,113C,136C,140C,152C,160C,194C,207C,228C,234C,273C,294C,341C,352C 'trust':382C 'turn':53B,231C 'type':122C 'upgrad':304C,346C 'valu':177C 'variabl':77B,170C,243C 'version':259C,274C,308C 'without':252C 'workaround':342C 'would':235C","nicknames":[],"mitigations":[],"who_affected":"Teams running agents built on the Strands Agents SDK that load the strands-agents-tools environment tool, where the agent processes untrusted content such as web pages, documents or emails. Agents without the environment tool, or on version 0.8.6 or later, are not affected. Exposure is highest when the agent host holds long-lived cloud credentials or API keys in its process environment.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-154-aws/#GHSA-qjx4-hg6g-2f34","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-154-aws/","severity":null,"published_at":"2026-10-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-28T20:07:44+00:00","fetched_at":"2026-10-28T20:07:44+00:00","note":"AWS: CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools"}],"documents":[{"id":12243,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-154-aws/","title":"AWS: CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools","kind":"advisory","source":"lab","text":"CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools\n\n### CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools\n\nBulletin ID: 2026-154-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 12:30 PM PDT\n\nDescription:\n\nStrands Agents Tools (strands-agents-tools) is an open-source Python package of pre-built tools for the Strands Agents SDK. The environment tool lets an agent list, read, set, and delete environment variables on the agent host, and masks values that look like secrets by default. We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language model (LLM) through its tool schema. A crafted prompt, delivered through content the agent is asked to process, could instruct the model to call the tool with masking turned off. The tool would then return the agent host's environment variables in cleartext, including cloud credentials and API keys, without prompting the operator for consent.\n\nImpacted versions: >= 0.1.0 AND < 0.8.6\n\nResolution:\n\nThis issue has been addressed in strands-agents-tools version 0.8.6. Masking is now controlled only by the operator, and the model can no longer disable it. The environment tool is also deprecated as of this release. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. We also recommend rotating any credentials that were present in the environment of agents that loaded the environment tool.\n\nWorkarounds:\n\nIf you cannot upgrade right away, remove the environment tool from your agents. Avoid running agents with long-lived cloud credentials or API keys in the process environment, and restrict outbound network access from the agent host to trusted endpoints only.\n\nReferences:\n\n- CVE-2026-115415\n- GHSA-qjx4-hg6g-2f34\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-28T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}