---
title: AWS: a prompt injection could make Strands Agents' environment tool switch off secret masking and return the host's cloud keys in cleartext (CVE-2026-115415); fixed in strands-agents-tools 0.8.6 | ctxsec
url: https://ctxsec.com/items/aws-strands-agents-tools-cve-2026-115415-env-tool-unmask-secrets
description: ""
status: "official (AWS Security Bulletin 2026-154-AWS, Oct 28; GHSA-qjx4-hg6g-2f34)"
published: 2026-10-29
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/aws-strands-agents-tools-cve-2026-115415-env-tool-unmask-secrets.md)

official (AWS Security Bulletin 2026-154-AWS, Oct 28; GHSA-qjx4-hg6g-2f34)

2026-10-29

### AWS: a prompt injection could make Strands Agents' environment tool switch off secret masking and return the host's cloud keys in cleartext (CVE-2026-115415); fixed in strands-agents-tools 0.8.6

The `environment` tool in the open-source `strands-agents-tools` package lets an agent list, read, set and delete environment variables, and masks secret-looking values by default. The masking switch was part of the tool schema, so the model could set it. Content the agent was asked to process could instruct the model to call the tool with masking off, returning cloud credentials and API keys in cleartext without asking the operator.

- **Affected:** versions 0.1.0 up to 0.8.5. **Fixed:** 0.8.6, where only the operator controls masking; the environment tool is now deprecated.
- **AWS recommends:** upgrade, patch any forks, and **rotate credentials** that were in the environment of agents that loaded this tool. If you cannot upgrade, remove the tool, avoid long-lived keys in agent process environments, and restrict agent egress to trusted endpoints.

**Take:** a "safe by default" flag that the model can flip is not a control. This is the same lesson as the Agno PandasTools bug earlier today; see the tip on model-controlled tool parameters.

Sources: [AWS Security Bulletin 2026-154-AWS: CVE-2026-115415, secret masking bypass in the environment tool in Strands Agents Tools (Oct 28)](https://aws.amazon.com/security/security-bulletins/2026-154-aws/) · [GitHub advisory GHSA-qjx4-hg6g-2f34](https://github.com/advisories/GHSA-qjx4-hg6g-2f34)