AWS fixes Strands tool secret masking and advises credential rotation
The issue concerns the environment tool in strands-agents-tools; the advisory does not establish an AWS-account breach.
AWS disclosed CVE-2026-115415 on October 28. In strands-agents-tools versions from 0.1.0 up to, but excluding, 0.8.6, malicious content could cause the environment tool to disable secret masking and return environment variables, potentially including API keys, to the model.
Version 0.8.6 fixes the issue, moves masking control to the operator and deprecates the tool. AWS advises upgrading, patching derived versions and rotating credentials present in agents’ environments where this tool was loaded. If an immediate upgrade is impossible, it recommends removing the tool.
This is a specific open-source package advisory, not confirmation that every user was compromised or a new web/app/API service. Local service eligibility, prices and language support in Hong Kong, Macau and Taiwan are unconfirmed. No account scan, exploit test, update or key rotation was performed.
https://github.com/strands-agents/tools/security/advisories/GHSA-qjx4-hg6g-2f34
Version 0.8.6 fixes the issue, moves masking control to the operator and deprecates the tool. AWS advises upgrading, patching derived versions and rotating credentials present in agents’ environments where this tool was loaded. If an immediate upgrade is impossible, it recommends removing the tool.
This is a specific open-source package advisory, not confirmation that every user was compromised or a new web/app/API service. Local service eligibility, prices and language support in Hong Kong, Macau and Taiwan are unconfirmed. No account scan, exploit test, update or key rotation was performed.
https://github.com/strands-agents/tools/security/advisories/GHSA-qjx4-hg6g-2f34
Usage conditions
- Hong Kong
- Exposure depends on the affected package and loaded environment tool, not a Hong Kong rollout. Local hosted-service availability, prices, plans and Traditional Chinese support are unconfirmed.
- Macau
- Exposure depends on the affected package and loaded environment tool, not a Macau rollout. Local hosted-service availability, prices, plans and Traditional Chinese support are unconfirmed.
- Taiwan
- Exposure depends on the affected package and loaded environment tool, not a Taiwan rollout. Local hosted-service availability, prices, plans and Traditional Chinese support are unconfirmed.