CVE-2026-115415Medium· 6.5▾ SunlitImproper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking.
To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.
strands-agents-tools >= 0.1.0 < 0.8.6Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112380Critical· 9.9Missing authorization in the WhatsApp channel in Kiro Crew
CVE-2026-35559Medium· 6.5Out-of-bounds write in query processing components in Amazon Athena ODBC driver
CVE-2026-8178High· 8.1Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver
CVE-2026-35561High· 7.4Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver
CVE-2026-35558High· 7.8Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver
CVE-2026-35560High· 7.4Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver