CVE-2026-115415

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking.

To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
amazon	strands-agents-tools	>= 0.1.0, < 0.8.6

References

Timeline

Published: Oct 28, 2026
Last modified: Nov 5, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1154167.7Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS accou CVE-2026-1154177.5Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote act CVE-2026-1154187.3SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redsh CVE-2026-1154198.1The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 doe CVE-2026-1154245.5A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly CVE-2026-1154255.6Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to CVE-2026-1154265.5The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before CVE-2026-1154317.1Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Expl CVE-2026-1154488.7Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, CVE-2026-1154493.5A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the h CVE-2026-115453.7IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console d CVE-2026-1154507.1External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an a