CVE-2026-115415

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's...

CVE-2026-115415

The Strands Agents Tools software, in versions prior to 0.8.6 , contains an improper neutralization of input used for LLM prompting within the environment tool . This vulnerability allows remote actors to bypass the tool's secret masking functionality using a crafted prompt. Successful exploitati...

EUVD-2026-112407

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's...

CVE-2026-115415 Secret masking bypass in the environment tool in Strands Agents Tools

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's...

PT-2026-129166

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's...