CVE-2026-15737 - Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK
CVE-2026-15737 is a sensitive content disclosure vulnerability in the Bedrock AgentCore Python SDK's OpenTelemetry instrumentation. Versions 1.4.8 and 1.5.0 of the SDK wrote raw user prompts and complete agent responses into OpenTelemetry span attributes without filtering or masking. These spans are sent to the aws/spans CloudWatch log group, where any local authenticated user with CloudWatch Logs read access could view potentially sensitive information. The issue is fixed in version 1.5.1 and later. Users are advised to upgrade and purge sensitive data from affected CloudWatch logs.
AI Analysis
Technical Summary
The Bedrock AgentCore Python SDK (bedrock-agentcore) versions 1.4.8 and 1.5.0 contain a vulnerability (CVE-2026-15737) in their OpenTelemetry instrumentation that causes raw user prompts and full agent responses to be logged as span attributes. These spans are stored in the aws/spans CloudWatch log group, exposing sensitive content to any local authenticated user with read access to CloudWatch Logs. This disclosure risk arises from the lack of filtering or masking of sensitive data before logging. The vulnerability is resolved in version 1.5.1 and later, which no longer logs sensitive content in this manner.
Potential Impact
Sensitive user prompts and agent responses are exposed in CloudWatch Logs, potentially allowing local authenticated users with CloudWatch Logs read permissions to access confidential or sensitive information. This could lead to unintended data disclosure within an organization. There is no indication of remote exploitation or privilege escalation beyond existing CloudWatch Logs read access.
Mitigation Recommendations
An official fix is available in Bedrock AgentCore Python SDK version 1.5.1 and later. Users should upgrade to version 1.5.1 or newer to remediate this vulnerability. Additionally, users who have run affected versions (1.4.8 and 1.5.0) should review and purge any sensitive content from their aws/spans CloudWatch log groups. No workarounds are available.
CVE-2026-15737 - Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK
Description
CVE-2026-15737 is a sensitive content disclosure vulnerability in the Bedrock AgentCore Python SDK's OpenTelemetry instrumentation. Versions 1.4.8 and 1.5.0 of the SDK wrote raw user prompts and complete agent responses into OpenTelemetry span attributes without filtering or masking. These spans are sent to the aws/spans CloudWatch log group, where any local authenticated user with CloudWatch Logs read access could view potentially sensitive information. The issue is fixed in version 1.5.1 and later. Users are advised to upgrade and purge sensitive data from affected CloudWatch logs.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Bedrock AgentCore Python SDK (bedrock-agentcore) versions 1.4.8 and 1.5.0 contain a vulnerability (CVE-2026-15737) in their OpenTelemetry instrumentation that causes raw user prompts and full agent responses to be logged as span attributes. These spans are stored in the aws/spans CloudWatch log group, exposing sensitive content to any local authenticated user with read access to CloudWatch Logs. This disclosure risk arises from the lack of filtering or masking of sensitive data before logging. The vulnerability is resolved in version 1.5.1 and later, which no longer logs sensitive content in this manner.
Potential Impact
Sensitive user prompts and agent responses are exposed in CloudWatch Logs, potentially allowing local authenticated users with CloudWatch Logs read permissions to access confidential or sensitive information. This could lead to unintended data disclosure within an organization. There is no indication of remote exploitation or privilege escalation beyond existing CloudWatch Logs read access.
Mitigation Recommendations
An official fix is available in Bedrock AgentCore Python SDK version 1.5.1 and later. Users should upgrade to version 1.5.1 or newer to remediate this vulnerability. Additionally, users who have run affected versions (1.4.8 and 1.5.0) should review and purge any sensitive content from their aws/spans CloudWatch log groups. No workarounds are available.
Technical Details
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-058-aws/","fetched":true,"fetchedAt":"2026-07-16T17:13:06.493Z","wordCount":199}
Threat ID: 6a59112268715ace43654905
Added to database: 07/16/2026, 17:13:06 UTC
Last enriched: 07/16/2026, 17:13:29 UTC
Last updated: 07/16/2026, 22:22:24 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.