EUVD-2026-44988Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the prerequisite OTel-to-CloudWatch configuration; PR:L for required authenticated CloudWatch Logs read access; UI:R because a victim user must actively invoke the agent to generate logged content.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
1DescriptionCVE.org
AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform.
Unintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 might allow a local authenticated user with access to CloudWatch Logs to access raw user prompts and agent responses containing sensitive data via span attributes. The SDK wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, exposing sensitive content to any principal with log read access.
We recommend you upgrade to version 1.5.1 or later. Users who ran affected versions should also review and purge sensitive content from their aws/spans CloudWatch log groups.
AnalysisAI
Unintended sensitive data exposure in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 allows any low-privileged IAM principal with CloudWatch Logs read access to retrieve verbatim user prompts and complete AI agent responses from the aws/spans log group. The SDK's OpenTelemetry instrumentation populates span attributes with raw conversational content on every invocation without filtering or masking, and these spans are automatically exported to CloudWatch, bypassing any application-layer data controls. No public exploit has been identified at time of analysis, but the exposure is systemic and requires no special tooling beyond standard AWS console or CLI access with logs read permissions; vendor-released patch version 1.5.1 is available.
Technical ContextAI
This vulnerability is an instance of CWE-532 (Insertion of Sensitive Information into Log File), where observability instrumentation inadvertently becomes a data leakage vector. The AWS Bedrock AgentCore Python SDK (CPE: cpe:2.3:a:aws:bedrock-agentcore:*:*:*:*:*:*:*:*) integrates OpenTelemetry (OTel) to instrument AI agent lifecycle events. OpenTelemetry spans carry structured key-value attributes intended for latency, status, and metadata - not natural-language content. In affected versions 1.4.8 and 1.5.0, the SDK writes the literal text of user prompts and full agent responses into these span attributes on every call, then exports them to the customer's aws/spans CloudWatch Logs log group via the OTel CloudWatch exporter. Because CloudWatch Logs access is governed by IAM policy rather than application-layer access controls, any principal granted logs:GetLogEvents or logs:FilterLogEvents on that log group - including developers, auditors, data engineers, or misconfigured service roles - can read sensitive conversational data. The flaw affects all workloads where the OTel instrumentation is active and spans flow to CloudWatch, which is the default configuration of the SDK.
RemediationAI
Vendor-released patch: version 1.5.1, available immediately at https://pypi.org/project/bedrock-agentcore/1.5.1/; upgrade by running pip install bedrock-agentcore>=1.5.1. Beyond patching, the vendor explicitly recommends that organizations which ran versions 1.4.8 or 1.5.0 review and purge sensitive content from their aws/spans CloudWatch log groups, as historical log data persists independently of the SDK upgrade. Log retention policies and log group deletion can be managed via the AWS Console, AWS CLI (aws logs delete-log-group --log-group-name aws/spans), or CloudWatch Logs API - note that purging logs is irreversible and may affect audit trail requirements. As a compensating control for deployments that cannot immediately upgrade, restricting IAM permissions on the aws/spans log group to the minimum required principals (removing logs:GetLogEvents and logs:FilterLogEvents from broad roles) reduces the exposure window, but does not stop the SDK from writing sensitive data into spans. Consult the full advisory at https://aws.amazon.com/security/security-bulletins/2026-058-aws/ for additional vendor-recommended guidance.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today