CVE-2026-15737

Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK

Published Jul 16, 2026 CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Description

AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform.

Unintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 might allow a local authenticated user with access to CloudWatch Logs to access raw user prompts and agent responses containing sensitive data via span attributes. The SDK wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, exposing sensitive content to any principal with log read access.

We recommend you upgrade to version 1.5.1 or later. Users who ran affected versions should also review and purge sensitive content from their aws/spans CloudWatch log groups.

Analysis

Technical impact

An unintentional feature of the AWS Bedrock AgentCore Python SDK logs raw user prompts and full agent responses directly into OpenTelemetry span attributes without filtering. These attributes are exported to CloudWatch Logs, resulting in sensitive data being exposed to any party that can read the logs.

Affected Systems

The vulnerability affects AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0. Users of these SDKs for building AI agents on the Bedrock platform are therefore at risk.

Risk and Exploitability

The CVSS score of 5.7 indicates a moderate severity. The EPSS score is < 1%, suggesting the likelihood of exploitation is very low; the issue is not listed in the CISA KEV catalog. The principal attack vector requires local authentication and log‑read access to CloudWatch. A user with those privileges can retrieve sensitive prompts and responses from the aws/spans log group, compromising confidentiality. While the vulnerability does not allow remote code execution or privilege escalation, it permits data exfiltration for authenticated users who have the ability to read the logs.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

AWS

bedrock-agentcore

unaffected

Version	Status	Constraints
`1.4.8`	affected	—
`1.5.0`	affected	—

No data.

Vendor Product Versions

Aws

Bedrock-agentcore

Version	Status	Scheme	Platform
`1.4.8`	affected	semver	—
`1.5.0`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to version 1.5.1 or later to mitigate the CWE-532 vulnerability by preventing sensitive data from being recorded in OpenTelemetry spans
After the upgrade, identify and purge any aws/spans CloudWatch log entries that contain sensitive prompts or responses that were captured due to the CWE-532 issue
Restrict CloudWatch log read permissions to only those principals that truly require access, following least‑privilege principles to limit exposure from the CWE-532 flaw

Generated by OpenCVE AI on August 1, 2026 at 08:40 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.382% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://aws.amazon.com/security/security-bulletins/2026-058-aws/
https://github.com/aws/bedrock-agentcore-sdk-python/security/advisories/GHSA-hqf8-7w95-9r33
https://pypi.org/project/bedrock-agentcore/1.5.1/

History

Jul 16, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 16, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. Unintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 might allow a local authenticated user with access to CloudWatch Logs to access raw user prompts and agent responses containing sensitive data via span attributes. The SDK wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, exposing sensitive content to any principal with log read access. We recommend you upgrade to version 1.5.1 or later. Users who ran affected versions should also review and purge sensitive content from their aws/spans CloudWatch log groups.
Title		Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK
First Time appeared		Aws Aws bedrock-agentcore
Weaknesses		CWE-532
CPEs		cpe:2.3:a:aws:bedrock-agentcore:1.4.8:::::::* cpe:2.3:a:aws:bedrock-agentcore:1.5.0:::::::*
Vendors & Products		Aws Aws bedrock-agentcore
References		https://aws.amazon.com/security/security-bulletins/2026-058-aws/ https://github.com/aws/bedrock-agentcore-sdk-python/security/advisories/GHSA-hqf8-7w95-9r33 https://pypi.org/project/bedrock-agentcore/1.5.1/
Metrics		cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 5.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`