CVE-2026-115415

Strands environment tool lets the model disable secret masking

AWS / Strands Agents · strands-agents-tools environment tool

First documented disclosure · Review checkpoint

Summary

Injected instructions can make an agent expose environment credentials in cleartext.

Severity and exploitation evidence

Medium · 5.9/10 · CVSS 4.0. Severity source.

Exploitation not established: AWS and the maintainer confirm the vulnerability; the reviewed sources do not report malicious exploitation or an affected victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The masking flag is part of the model-controlled tool schema. List and get operations can disable masking without operator consent; another loaded tool could transmit the returned secrets.

Conditions required

An agent loads the environment tool, has sensitive environment variables, and processes attacker-influenced instructions. Exfiltration needs a suitable output or additional tool.

Potential impact

Disclosure of cloud credentials, model-provider keys or other host environment secrets.

Affected versions and configurations

>=0.1.0 and <0.8.6.

Fix and mitigation status

0.8.6; masking control moves to the operator's environment setting and the tool is deprecated.

Practical next steps

Upgrade or remove the environment tool. Follow AWS advice to rotate credentials present in environments of agents that loaded it; limit long-lived secrets and outbound access.

Operating lesson

A model must not control whether a security boundary masks credentials.

Evidence and limits

Public fix PR 545 opened July 27 and merged July 29; the fixed release shipped August 7. AWS's October 28 bulletin and CNA registration do not reset the disclosure date. The CNA also supplies a 6.5 CVSS 3.1 score; displayed 5.9 is its CVSS 4.0 assessment.

Sources