Strands Agents Tools
Approved changes feed: RSS · Atom
cpe:2.3:a:amazon:strands-agents-tools:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Amazon (0ed129a9-8e26-53dc-aefe-55957e638c30) |
|---|---|
| Product | Strands Agents Tools (22b6d916-ca21-5b33-9a8d-19407c3523d4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-115415 |
vulnerable | 2026-11-03 10:15:37.732966 |
Secret masking bypass in the environment tool in Strands Agents Tools
MEDIUM (6.5)
Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking.
To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.
Published: 2026-10-28T19:33:10.542Z
Updated: 2026-11-05T16:49:46.951Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.