CVE-2026-15737: AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on t
Summary
AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 unintentionally logged sensitive user data in OpenTelemetry span attributes (metadata tags that track operations), which then flowed into CloudWatch Logs (AWS's logging service) where anyone with log access could read them. This meant raw user prompts and AI agent responses were stored unfiltered in logs, exposing sensitive information.
Solution / Mitigation
Upgrade to version 1.5.1 or later. Additionally, users who ran the affected versions should review and purge sensitive content from their aws/spans CloudWatch log groups.
Vulnerability Details
5.7(medium)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
network
low
low
required
July 16, 2026
Classification
Affected Vendors
Related Issues
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-15737
First tracked: July 17, 2026 at 02:08 AM
Classified by LLM (prompt v3) · confidence: 95%