Strands Agents Tools EUVD-2026-112407

Exploitation requires all of the following concrete conditions, taken from the vendor advisory: (1) the agent must have the Strands Agents Tools 'environment' tool loaded (versions >= 0.1.0 and < 0.8.6); (2) the agent must process attacker-controlled content - a web page, file, or prior tool output - into which the actor has placed instructions (this is the UI:A / indirect prompt-injection requirement); (3) the model must be induced to call the tool with action="list" (or "get") and masked=false, which was possible because the masked flag was exposed in the tool's input schema and list/get actions ran without an operator consent prompt; and (4) secrets must actually be present in the agent host's process environment (e.g., AWS keys, API tokens) for there to be anything to leak, with exfiltration typically needing a second loaded tool that has outbound network access. Limiting factors: no effect on deployments that never load the environment tool or that run agents without long-lived credentials in the environment; exploitation is gated on the agent ingesting attacker content rather than on direct network access to a service.

This is a genuine but conditional-risk information-disclosure flaw, not a drop-everything emergency. The CVSS 4.0 base score is 5.9 (medium), and the vector tells a consistent story: AV:N and PR:N mean a remote, unauthenticated actor can reach the condition, but UI:A (the agent must actively process the attacker's content) and AT:P (a specific attack requirement must hold) materially constrain exploitation - this is indirect/stored prompt injection, not a direct network exploit. VC:H with VI:N/VA:N correctly reflects a pure confidentiality loss (full disclosure of host environment variables, including AWS keys and API tokens) with no integrity or availability impact and no vendor-asserted scope change (SC/SI/SA:N). Exploitation signals are mostly absent: the input shows no CISA KEV entry, no EPSS probability, and no PoC/exploit reference - the references are the AWS bulletin, the GitHub release, and the GHSA advisory, none of which is working exploit code. The vuln.today decision label is 'this_month', not act_now/emergency, which aligns with a medium score and the lack of confirmed active exploitation. The main driver that could elevate real-world impact is the nature of the leaked data: harvested long-lived cloud credentials enable lateral movement far beyond the agent host. Net: treat as a real priority for anyone running the affected tool with credentials in the process environment, but it is not a mass-exploitable remote code execution. Missing data to note explicitly: EPSS score is not provided, so quantitative exploitation likelihood cannot be stated, and KEV/PoC status is 'none in input' rather than an affirmative 'not exploitable'.

An attacker plants crafted instructions in content the agent will ingest - a web page, a document, or prior tool output - directing the model to call the environment tool with action="list" and masked=false. Because the masked flag was exposed in the tool's input schema and list/get required no operator consent, the tool returns every environment variable unmasked (AWS access keys, model-provider API keys, source-control tokens, DB connection strings), which the model can then relay to the attacker through another loaded tool with outbound access. No public exploit was identified at time of analysis; exploitation requires the agent to actively process the attacker-controlled content (UI:A) and to have the environment tool loaded.