AWS Strands Agents Tools CVE-2026-115415: A Crafted Prompt Can Unmask Your Agent's Keys. Update to 0.8.6

TL;DR: AWS says a crafted prompt hidden in content an agent reads can make the environment tool in Strands Agents Tools, its open-source tool pack for the Strands Agents SDK, return the host’s environment variables in clear text, including cloud credentials and API keys. The flaw, CVE-2026-115415, affects versions 0.1.0 through 0.8.5 and is fixed in 0.8.6. AWS also recommends rotating any keys that sat in the environment of an agent that loaded the tool. No attacks have been reported.

What happened

The flaw: AWS published Security Bulletin 2026-154-AWS on October 28, 2026, at 12:30 p.m. Pacific (3:30 a.m. October 29, Manila), with matching GitHub advisory GHSA-qjx4-hg6g-2f34. The environment tool lets an agent list, read, set and delete environment variables, and by default it masks values whose names look like secrets, such as names containing KEY, TOKEN, SECRET or PASSWORD. But the on/off switch for that masking was part of the tool’s input, which the AI model fills in. GitHub’s advisory adds that listing and reading variables didn’t ask the operator for consent; only setting and deleting did.

How an attack would work: According to the advisory, anyone who can put instructions into something the agent processes, such as a web page, a file or another tool’s output, could tell the model to list every variable with masking off. The model could then send the values out through another tool the agent has loaded. That’s a prompt injection: the attacker never touches your server, only content your agent reads.

Who is affected: strands-agents-tools 0.1.0 through 0.8.5, on agents that load the environment tool. GitHub rates it Moderate (CVSS 3.1 score 6.5), because an attack needs the agent to process attacker-controlled content.

The fix: Version 0.8.6, released on PyPI on August 7, 2026 (UTC), well before the advisory. Masking is now set only by the operator, through the ENV_VARS_MASKED_DEFAULT environment variable (on by default), and the model can no longer turn it off. The tool is also deprecated as of 0.8.6. The newest release is 0.8.10 (October 21, UTC).

Exploitation: AWS and GitHub don’t report any attacks, and the CVE wasn’t in CISA’s KEV catalog at our check.

Why it matters

Agents that read the web, email or uploaded files are exactly the ones that tend to run with powerful keys in their environment: an AWS access key, an OpenAI or Anthropic API key, a GitHub token. This flaw meant a single poisoned page could talk the agent into handing all of them over, with no consent prompt. Our read: the affected range goes back to version 0.1.0 in May 2025, so if you haven’t upgraded since early August, check now, because the fix has existed since August but the advisory only went out this week. Leaked keys are the costly part; we covered what to rotate when a poisoned LiteLLM release shipped a credential stealer, and our Security hub tracks other patches worth doing now.

What to do now

1. Find agents that load the tool. Search your code for environment in the tools you pass to your Strands agents.
2. Upgrade. Run pip install -U strands-agents-tools (or bump it in your lock file) to get 0.8.6 or later, and redeploy.
3. Rotate the keys. AWS recommends rotating every credential that was in the environment of an agent that loaded the tool. Start with cloud keys and paid model API keys, and check their usage logs for calls you don’t recognize.
4. Shrink what agents can reach. Our advice, in line with AWS’s workaround: give agents short-lived, narrowly scoped credentials instead of long-lived keys, and only let the agent host talk to the endpoints it needs. See our guide on stopping agents from trusting the wrong tool outputs.

Updates

• Oct 29, 2026, 7:40 p.m. Manila: First published.

Sources & method

Sources

• AWS Security Bulletin 2026-154-AWS, CVE-2026-115415 (Oct 28, 2026)
• GitHub security advisory GHSA-qjx4-hg6g-2f34, strands-agents/tools (Oct 28, 2026)
• strands-agents/tools v0.8.6 release notes
• strands-agents/tools pull request #545, “fix(environment): drive value masking from environment variable”
• strands-agents-tools on PyPI (release history)
• CISA Known Exploited Vulnerabilities catalog (version 2026.10.28)

Method. Checked October 29, 2026, at about 7:00 p.m. Manila time (11:00 UTC). The affected and fixed versions, the workaround and the rotation advice come from AWS’s bulletin and the GitHub advisory; the severity score from the GitHub advisory; the ENV_VARS_MASKED_DEFAULT detail from the fix’s pull request; and the release dates from PyPI. We checked CISA’s KEV catalog (version 2026.10.28). Steps labelled “our advice” and “our read” are our own judgment, not AWS’s. The thumbnail is the preview image of the Strands Agents website. No affiliate links on this page. How we work.