A prompt in content processed by an agent can cause the environment tool to return credentials without masking. Update strands-agents-tools and rotate credentials from agent environments that loaded the tool.
Who should check: Teams whose agents load the environment tool from strands-agents-tools 0.1.0 through versions before 0.8.6.
Update to 0.8.6 or later and rotate credentials present in environments of agents that loaded the environment tool. If upgrading is not possible immediately, remove the tool.
The environment tool exposed its masking control to the model. Instructions placed in content processed by an agent could cause secrets in its host environment to be returned without masking or operator approval.
Version 0.8.6 moves masking control to the operator and deprecates the tool. AWS also recommends rotating credentials present in environments of agents that loaded it. The additional-action status reflects this credential task; a software fix is available.
This is a separate package and failure from the Strands SDK A2A session-isolation advisory. Updating one does not establish that the other has been remediated. The reviewed vendor advisories do not establish exploitation in the wild or exposure of a particular deployment.
| Product | Affected | Fixed release / action |
|---|---|---|
| strands-agents-tools with environment loaded | 0.1.0 and later, before 0.8.6 | 0.8.6 |
Use the guidance for your product and release branch. Confirm distribution backports with the vendor; the product name alone does not establish exposure.
The affected tool must be loaded and the agent must process attacker-controlled instructions. AWS recommends an update and credential rotation; the reviewed vendor sources do not establish attacks in the wild.
The model could disable a control intended to protect secrets. Review which tools can read credentials and which can send data outside the host.
Added advisory coverage with product-specific response steps and dated exploitation evidence.
Use this checklist to decide whether the advisory affects your systems, record what your team does and share the result. Radar does not scan or verify your environment.
Changes save automatically in this browser. They are not synced with your team or sent to Oktsec.
Check affected systems and versions, then record your decision below. If you are unsure, choose “Needs verification”.
Name the system and person or team handling the work. Update each action as you go; add a ticket reference or notes to explain what was checked.
Check package versions, tool configuration and deployed forks. Installing the package alone does not establish that the affected tool was loaded.
Install 0.8.6 or later and patch derivative code. If an immediate update is not possible, remove environment from the agent. The tool is deprecated in 0.8.6.
Follow AWS guidance for credentials that were present in environments of agents that loaded the tool. Coordinate replacement and revocation across cloud keys, API tokens and other secrets; updating the package alone is not credential rotation.
Confirm the deployed package and tool configuration. Avoid persistent credentials in the process environment and restrict outbound destinations as recommended by AWS. Review suspected exposure separately.
Download a Markdown file with your decision, action status, notes and source links. Share it with your team or attach it to a ticket.
Compare the running version and configuration with the vendor guidance.
| Product | Affected | Fixed release / action |
|---|---|---|
| strands-agents-tools with environment loaded | 0.1.0 and later, before 0.8.6 | 0.8.6 |
Confirm distribution backports with the vendor. A matching product alone does not establish exposure.
The affected tool must be loaded and the agent must process attacker-controlled instructions. AWS recommends an update and credential rotation; the reviewed vendor sources do not establish attacks in the wild.
Prioritization criteriaCatalog 2026.10.28 · Checked Oct 28, 2026 UTC
No matching CVE appears in the reviewed catalog snapshot. This does not establish that exploitation has not occurred. Check the incident sources and vendor guidance.
| Product / CVE | Attack evidence | Source guidance |
|---|---|---|
| strands-agents-toolsCVE-2026-115415 | Attacks not established The reviewed evidence does not establish whether this vulnerability was used in attacks. | Strands Agents sourceReview affected systems |
Forecast unavailable. This is not a zero score.
FIRST EPSS · Checked 2026-10-27 15:30 UTC
Priority applies to the parent advisory, not separately to every product or CVE. Each row shows only the evidence attributed to that CVE. Missing attack evidence does not mean a vulnerability is safe to ignore. Your environment has not been scanned.
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.
| Product / service | strands-agents-toolsStrands Agents |
|---|---|
| CVE | CVE-2026-115415 |
| Exploitation evidence | Attacks not established |
| Access required | Application or configuration dependent |
| Vendor severity | 6.5CVSS 3.1 |
| Severity by CVE | CVE-2026-115415 · 6.5 · CVSS 3.1 |
| Fix / response | Additional action requiredAffected versions and fixes |
The model could disable a control intended to protect secrets. Review which tools can read credentials and which can send data outside the host.