# Strands Agents Tools: a prompt turns off the environment tool's masking

> The environment tool in Strands Agents Tools took its masking switch from the model, so the model could be talked into unmasking secrets.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Strands Agents
- **Disclosed:** 2026-10-28
- **CVE:** CVE-2026-115415
- **CVSS:** 6.5
- **Affects:** Strands Agents Tools, strands-agents-tools (PyPI)
- **Research by:** [Strands Agents maintainers](https://github.com/strands-agents) (AWS)
- **Primary source:** https://github.com/strands-agents/tools/security/advisories/GHSA-qjx4-hg6g-2f34
- **Page:** https://theinjection.dev/items/strands-agents-tools-environment-secret-masking/

Strands Agents Tools exposed the agent host's environment variables, including cloud keys and API tokens, when a crafted prompt turned off the environment tool's secret masking. AWS fixed it in 0.8.6 and deprecated the tool.

## What happened

The Strands Agents project published advisory GHSA-qjx4-hg6g-2f34 on October 28, 2026 for CVE-2026-115415, and AWS issued security bulletin 2026-154 the same day. Neither names an outside reporter. Release 0.8.6 carries the fix and also deprecates the environment tool.

## How it works

Masking is the control at issue: the environment tool hides values whose names contain KEY, TOKEN, SECRET or PASSWORD. The masked parameter sat in the tool's input schema, so the model itself could set it, and the list and get actions ran without the operator consent prompt that set and delete required. Instructions hidden in a web page, a file or another tool's output could therefore direct the model to call the tool with masking off, then hand the values to an attacker through a second loaded tool.

## Who is affected

Agents that load the environment tool from strands-agents-tools 0.1.0 up to 0.8.6 are exposed. AWS names cloud keys, model provider API keys, source control tokens and database connection strings among the values the tool could print. An agent that never loads the tool is not affected.

## What to do

Upgrade to strands-agents-tools 0.8.6, where masking is operator-controlled and the model cannot disable it, and rotate any credential that sat in the environment of an agent that loaded the tool. AWS also advises removing the tool, keeping long-lived credentials out of the process environment, and restricting outbound network access from agent hosts to trusted endpoints.

## Quick facts

- **Affected:** strands-agents-tools 0.1.0 up to 0.8.6
- **Fixed in:** strands-agents-tools 0.8.6, which also deprecates the environment tool
- **CVE:** CVE-2026-115415, CVSS 6.5 (v3.1), Moderate
- **Attack type:** Insufficiently protected credentials, CWE-522, reached through LLM prompting, CWE-1427
- **Disclosed:** October 28, 2026, by the project and in AWS bulletin 2026-154
- **Status:** Patched, with credential rotation advised for agents that loaded the tool

## Questions

### Am I affected if my Strands agent never loads the environment tool?

Agents that do not load the environment tool from strands-agents-tools are outside the described attack path, because the flaw lives in that tool's masking parameter. Exposure requires an agent to have the tool available and to process attacker-influenced content. AWS still advises upgrading to 0.8.6, since the release deprecates the tool and moves masking under operator control.

### Which version of Strands Agents Tools fixes CVE-2026-115415?

Version 0.8.6 of strands-agents-tools carries the fix for CVE-2026-115415, covering all releases from 0.1.0 onward. In that release the masking switch is controlled only by the operator, so the model can no longer request unmasked output, and the environment tool itself is deprecated. AWS bulletin 2026-154 adds that forks and derivative code need the same patch.

### Do I need to rotate credentials after upgrading Strands Agents Tools?

AWS advises rotating any credential that was present in the environment of an agent that loaded the environment tool, because upgrading does not undo a disclosure that already happened. The bulletin names cloud keys, model provider API keys, source control tokens and database connection strings as the kinds of values the tool could read in cleartext.

## Sources

1. [Project Advisory](https://github.com/strands-agents/tools/security/advisories/GHSA-qjx4-hg6g-2f34)
2. [AWS Bulletin 2026-154](https://aws.amazon.com/security/security-bulletins/2026-154-aws/)