What Happened
The Strands Agents Tools vulnerability CVE-2026-115415 can leak cloud credentials and API keys from an agent host, and that can cost you money when a client is hit. The fix is to update affected deployments and rotate any credentials that may have been exposed.
AWS published security bulletin 2026-154-AWS on October 28, 2026, identifying the issue in Strands Agents Tools. A crafted prompt can instruct the LLM to call the environment tool with secret masking turned off, and the tool then returns the host's environment variables in cleartext, including cloud credentials and API keys, without operator consent.
This is not a vulnerability that requires a direct network attack. The content an agent processes becomes the attack vector, which means any client that feeds untrusted documents, emails, or web pages into an LLM agent is exposed.
For an MSP, the immediate cost is the scramble to identify which environments are running the affected version, rotate credentials, and explain to a client what happened. The larger cost is the risk of a breach if those credentials are used before you act.
Timeline
- October 28, 2026, 12:30 PM PDT: AWS publishes security bulletin 2026-154-AWS identifying CVE-2026-115415 in Strands Agents Tools.
Who Is Affected
MSPs running Strands Agents Tools versions 0.1.0 and later, but earlier than 0.8.6, are in the affected range.
This includes MSPs that deploy LLM agents to read or process documents, emails, web content, or other untrusted input. Any environment where the agent host has access to cloud credentials or API keys is at risk if the tool is called with masking off.
AWS has not reported active exploitation of this vulnerability, but that does not reduce the need to act. The attack only requires a crafted prompt, so treat it as a live risk.
Strands Agents Tools Vulnerability: Why It Matters for MSPs
LLM agents are no longer experimental. They are becoming part of how MSPs automate ticket triage, log review, and client onboarding. When an agent processes content that an attacker controls, that content becomes an attack surface.
The specific problem here is that the environment tool accepts a masking parameter from the LLM. In normal use, masking is on, so secrets are redacted. With a crafted prompt, masking can be turned off, and the tool returns the host's environment variables in cleartext.
For an MSP, the danger is that the agent host often holds credentials that are more powerful than a single user account. Cloud credentials, API keys, and database connection strings can be sitting in environment variables. If an attacker gets those, they have a path into the client's infrastructure.
Technical Details
CVE-2026-115415 affects Strands Agents Tools versions >= 0.1.0 AND < 0.8.6.
Attack vector: The environment tool accepted a masking parameter from the large language model (LLM) through its tool schema. A crafted prompt, delivered through content the agent is asked to process, could instruct the model to call the tool with masking turned off. The tool would then return the agent host's environment variables in cleartext, including cloud credentials and API keys, without prompting the operator for consent.
What MSPs Should Do
Treat this like a credential exposure. Update the software, then rotate anything that could have leaked.
- Identify all deployments of Strands Agents Tools and check their versions against the affected range, >= 0.1.0 AND < 0.8.6.
- Upgrade Strands Agents Tools to 0.8.6 or later, or otherwise move outside the affected range.
- Rotate cloud credentials and API keys that were present in the environment variables of any affected agent host.
- Review agent logs for calls to the environment tool that may have returned cleartext values.
- Restrict access to the environment tool in your agent configurations where possible.
- Limit the environment variables available to agent hosts to only what each agent needs.
- Remind clients that LLM agents should not process untrusted content with access to sensitive environment variables unless controls are in place.
How EnterProtect Helps
EnterProtect backup keeps clean restorable copies of your clients' systems, so you can recover an agent host that has been compromised.
EnterProtect recovery gets a client running again after an incident, without depending on a suspect environment.
EnterProtect vulnerability scanning gives you a view of the software versions across your client fleet, so you can spot deployments that need updates before they become a problem.
Frequently Asked Questions
What Is CVE-2026-115415?
CVE-2026-115415 is a high-severity vulnerability in Strands Agents Tools. The environment tool accepts a masking parameter from the LLM, so a crafted prompt can turn off secret masking and leak environment variables.
How Does the Attack Work?
The attacker delivers a crafted prompt through content the agent is asked to process. The model calls the environment tool with masking off, and the tool returns the host's environment variables in cleartext, including cloud credentials and API keys.
Which Versions of Strands Agents Tools Are Affected?
Versions 0.1.0 and later, but earlier than 0.8.6, are in the affected range. Upgrade to 0.8.6 or later to move outside the affected range.
What Should I Do If I Run an Affected Version?
Update Strands Agents Tools to a version outside the affected range, rotate any cloud credentials and API keys that were in the agent host's environment, and review agent logs for calls that returned cleartext values.
Is CVE-2026-115415 Being Exploited in the Wild?
AWS has not reported active exploitation of this vulnerability. That can change quickly, so apply the update and rotate credentials as soon as possible.
Sources
- CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools (Aws Bulletins)