CVE-2026-115415 is a vulnerability in the environment tool of Strands Agents Tools where a crafted prompt can bypass secret masking. This allows an attacker to retrieve environment variables, including sensitive cloud credentials and API keys, in cleartext without operator consent. The issue affects versions from 0.1.0 up to but not including 0.8.6.