Secret masking bypass in the environment tool in Strands Agents Tools
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.8.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The environment tool in Strands Agents Tools, an add-on for building AI agents, is affected by this flaw. A remote attacker who sends a specially crafted prompt could bypass the tool's secret masking and read the host's environment variables in plain text, potentially exposing cloud credentials and API keys.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking. To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Affected versions
- amazon strands-agents-tools
From 0.1.0 · fixed in 0.8.6