CVE-2026-115415: A prompt can make the Strands Agents Tools environment tool return every environment variable unmasked, including cloud keys
The environment tool in strands-agents-tools masks secret-looking environment variables by default, but the masked switch was part of the tool's input schema, so the model could turn it off, and the list and get actions ran without operator consent. Instructions hidden in a web page, file or earlier tool output could make the agent list every variable unmasked, AWS keys and model API keys included, and pass them on through another tool. Fixed in 0.8.6, which also deprecates the tool.
What it is
The tool hides values whose names contain things like KEY, TOKEN, SECRET or PASSWORD, but the LLM could set masked=false because the parameter was exposed in the tool schema.
Only set and delete required confirmation, so action="list" with masked=false returned every environment variable in cleartext without asking the operator.
An attacker who can place instructions in content the agent reads can trigger this and then have the model send the values out through any other loaded tool.
Affected: strands-agents-tools 0.1.0 to before 0.8.6. AWS also covers it in security bulletin 2026-154-AWS.
How to check
- Affected: strands-agents-tools (PyPI) before 0.8.6, if any of your agents load the environment tool.
- Your risk is highest if those agents read untrusted content (web pages, files, email) and run with long-lived cloud credentials or API keys in their environment.
How to fix
- Upgrade strands-agents-tools to 0.8.6 or later; masking is now controlled only by the operator.
- Better still, remove the environment tool from your agents, since it is deprecated.
- Rotate any credentials that were in the environment of agents that loaded the tool, and limit outbound network access from agent hosts.
pip show strands-agents-tools | grep -i version
pip install -U 'strands-agents-tools>=0.8.6'