{"data":{"id":"69b6d155-5ac8-45ec-ba81-f3c33a783124","title":"CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools","summary":"CVE-2026-115415 affects the environment tool in Strands Agents Tools, versions >= 0.1.0 and < 0.8.6. The tool accepted a masking parameter from the LLM through its tool schema, so a crafted prompt in content the agent processes could turn masking off and return the host's environment variables in cleartext, including cloud credentials and API keys, without operator consent.","solution":"Fixed in 0.8.6 or later. Refer to AWS Security Bulletin 2026-154-AWS for the most up-to-date and complete information.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-154-aws/","publishedAt":"2026-10-28T19:39:08.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["prompt_injection","data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["Strands Agents Tools","AWS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-28T19:39:08.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"]}}