Input Neutralization Flaw in Strands Agents Tools from Strands

CVE-2026-115415

What is CVE-2026-115415?

The Strands Agents Tools prior to version 0.8.6 is affected by a vulnerability that allows an attacker to exploit improper neutralization of input used for LLM prompting. This security flaw enables remote actors to access sensitive environment variables in plaintext, such as cloud credentials and API keys, through a carefully crafted prompt that bypasses the tool's secret masking features. To mitigate risks, it is crucial for users to upgrade to version 0.8.6 or later and to promptly rotate any compromised credentials.

References