CVE-2026-15737

Executive Summary

CVE-2026-15737 is a medium-severity information disclosure vulnerability in the AWS Bedrock AgentCore Python SDK, versions 1.4.8 and 1.5.0. The flaw arises from unintended logging of sensitive user content into OpenTelemetry span attributes. When the SDK processes user prompts and agent responses, it writes the raw, unfiltered data into OpenTelemetry spans. These spans are then transmitted to the customer's aws/spans CloudWatch log group, where any local authenticated user with read access to CloudWatch Logs can access the sensitive data. The vulnerability has a CVSS score of 5.7, indicating a moderate risk primarily due to the potential exposure of confidential information. The vendor, AWS, has released version 1.5.1 to address this issue, and users are strongly advised to upgrade and purge any existing sensitive logs.

Supply Chain & Package Security

This vulnerability affects the aws-bedrock-agentcore-python-sdk package available on PyPI. Organizations using this SDK in their AI agent workflows are at risk. The exposure of raw prompts and responses can lead to leakage of proprietary business logic, personally identifiable information (PII), or other sensitive data. As a supply chain risk, any application that integrates this SDK and uses OpenTelemetry for monitoring is vulnerable. The patch (version 1.5.1) should be applied immediately, and all logs in the aws/spans CloudWatch log group should be reviewed and purged to remove any previously logged sensitive content.

CVSS Breakdown & Threat Level

• CVSS Score: 5.7 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Local (L) – The attacker must have local access to the system or network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs basic user privileges.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Sensitive data is fully exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires local access and low privileges, but the potential for high confidentiality impact makes it a significant concern for environments handling sensitive data.

Deep Dive & Mechanics

The vulnerability is rooted in the OpenTelemetry instrumentation within the AWS Bedrock AgentCore Python SDK. When the SDK processes a user prompt or generates an agent response, it creates OpenTelemetry spans to trace the execution. The SDK incorrectly writes the raw, unmodified user prompt and the complete agent response into the span attributes. This data is then exported to CloudWatch Logs under the aws/spans log group.

The core issue is the lack of filtering or masking of sensitive content before it is added to the span attributes. The SDK does not implement any data sanitization, meaning that any sensitive information contained in the prompts or responses (e.g., API keys, personal data, internal instructions) is exposed. An attacker with read access to the CloudWatch Logs can query these logs and extract the sensitive data.

The vulnerability affects versions 1.4.8 and 1.5.0. The fix in version 1.5.1 likely involves either removing the logging of raw content or implementing a masking/filtering mechanism to redact sensitive data before it is written to the span attributes.

Vulnerable vs. Patched Code

Vulnerable Code (versions 1.4.8 and 1.5.0):

# In the OpenTelemetry instrumentation module
from opentelemetry import trace

tracer = trace.get_tracer(__name__)

def process_prompt(prompt: str):
    with tracer.start_as_current_span("bedrock_agent") as span:
        span.set_attribute("user_prompt", prompt)  # Raw prompt logged
        response = agent.invoke(prompt)
        span.set_attribute("agent_response", response)  # Raw response logged
        return response

Patched Code (version 1.5.1):

# In the OpenTelemetry instrumentation module
from opentelemetry import trace
import re

tracer = trace.get_tracer(__name__)

def mask_sensitive_data(data: str) -> str:
    # Example masking: replace email addresses and API keys
    data = re.sub(r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}', '[EMAIL REDACTED]', data)
    data = re.sub(r'[A-Za-z0-9]{20,}', '[KEY REDACTED]', data)
    return data

def process_prompt(prompt: str):
    with tracer.start_as_current_span("bedrock_agent") as span:
        masked_prompt = mask_sensitive_data(prompt)
        span.set_attribute("user_prompt", masked_prompt)  # Masked prompt logged
        response = agent.invoke(prompt)
        masked_response = mask_sensitive_data(response)
        span.set_attribute("agent_response", masked_response)  # Masked response logged
        return response

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a system running AWS Bedrock AgentCore Python SDK version 1.4.8 or 1.5.0.
• The system must be configured to export OpenTelemetry spans to CloudWatch Logs.
• The attacker must have AWS credentials with logs:GetLogEvents permission on the aws/spans log group.

Exploitation Steps:

1. Identify the target: Find a system using the vulnerable SDK.
2. Access CloudWatch Logs: Use the AWS CLI or SDK to query the aws/spans log group.

   aws logs get-log-events --log-group-name aws/spans --log-stream-name <stream-name>
   

3. Extract sensitive data: Parse the log events to extract the user_prompt and agent_response attributes.

   import boto3
   client = boto3.client('logs')
   response = client.get_log_events(logGroupName='aws/spans', logStreamName='<stream>')
   for event in response['events']:
       print(event['message'])
   

Expected Outcome: The attacker gains access to raw user prompts and agent responses, potentially containing sensitive information.

Blue Team

Detection:

• Monitor CloudWatch Logs for unusual access patterns to the aws/spans log group.
• Use AWS CloudTrail to detect GetLogEvents API calls from unexpected principals.
• Implement alerts for any access to the aws/spans log group by non-admin users.

Mitigation:

• Immediately upgrade to version 1.5.1 of the SDK.
• Purge existing logs in the aws/spans log group using the AWS CLI:

  aws logs delete-log-group --log-group-name aws/spans
  

• Review IAM policies to restrict access to CloudWatch Logs to only necessary personnel.
• Enable data masking or filtering at the application level as a defense-in-depth measure.

Indicators of Compromise (IOCs)

• Log Group: aws/spans containing span attributes with raw user prompts and agent responses.
• Log Streams: Any log stream under aws/spans that contains span data from the vulnerable SDK.
• API Calls: GetLogEvents API calls targeting the aws/spans log group from unexpected IP addresses or IAM users.
• SDK Version: Presence of aws-bedrock-agentcore-python-sdk version 1.4.8 or 1.5.0 in the environment.

Detection Engineering

YARA Rule

rule Detect_Vulnerable_Bedrock_SDK {
    meta:
        description = "Detects vulnerable AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:example"
    strings:
        $sdk_version = /aws-bedrock-agentcore-python-sdk==1\.[45]\.[08]/
        $span_attribute = /span\.set_attribute\("user_prompt"/
    condition:
        $sdk_version or $span_attribute
}

Sigma Rule

title: AWS Bedrock AgentCore SDK Sensitive Data Exposure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects access to aws/spans CloudWatch log group which may contain sensitive data from vulnerable SDK
author: Valters IT
date: 2025/04/10
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: GetLogEvents
        requestParameters.logGroupName: aws/spans
    condition: selection
falsepositives:
    - Legitimate administrative access
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"AWS Bedrock SDK - Potential Sensitive Data Exposure"; flow:to_server; content:"aws/spans"; http_uri; content:"GetLogEvents"; http_method; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Upgrade: Update the aws-bedrock-agentcore-python-sdk to version 1.5.1 or later.

   pip install --upgrade aws-bedrock-agentcore-python-sdk==1.5.1
   

2. Purge Existing Logs: Delete the aws/spans CloudWatch log group to remove any previously logged sensitive data.

   aws logs delete-log-group --log-group-name aws/spans
   

3. Review IAM Policies: Restrict access to CloudWatch Logs to only authorized personnel. Use least privilege principles.
4. Implement Data Masking: As a defense-in-depth measure, implement application-level data masking for any logging of user prompts and agent responses.
5. Monitor for Unauthorized Access: Enable AWS CloudTrail and set up alerts for any access to the aws/spans log group.
6. Conduct Security Review: Review all applications using the SDK to ensure they are updated and no sensitive data remains in logs.

Valters IT