{"data":{"id":"388a0fa9-8335-4a41-8516-e1031ffde21a","title":"CVE-2026-15737: AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on t","summary":"AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 unintentionally logged sensitive user data in OpenTelemetry span attributes (metadata tags that track operations), which then flowed into CloudWatch Logs (AWS's logging service) where anyone with log access could read them. This meant raw user prompts and AI agent responses were stored unfiltered in logs, exposing sensitive information.","solution":"Upgrade to version 1.5.1 or later. Additionally, users who ran the affected versions should review and purge sensitive content from their aws/spans CloudWatch log groups.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15737","publishedAt":"2026-07-16T18:16:42.537Z","cveId":"CVE-2026-15737","cweIds":["CWE-532"],"cvssScore":"5.7","cvssSeverity":"medium","severity":"medium","attackType":["pii_leakage"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS Bedrock","AWS Bedrock AgentCore Python SDK"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-07-16T18:16:42.537Z","capecIds":["CAPEC-215"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}