An unintentional feature of the AWS Bedrock AgentCore Python SDK logs raw user prompts and full agent responses directly into OpenTelemetry span attributes without filtering. These attributes are exported to CloudWatch Logs, resulting in sensitive data being exposed to any party that can read the logs.

The vulnerability affects AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0. Users of these SDKs for building AI agents on the Bedrock platform are therefore at risk.

The CVSS score of 5.7 indicates a moderate severity. The EPSS score is < 1%, suggesting the likelihood of exploitation is very low; the issue is not listed in the CISA KEV catalog. The principal attack vector requires local authentication and log‑read access to CloudWatch. A user with those privileges can retrieve sensitive prompts and responses from the aws/spans log group, compromising confidentiality. While the vulnerability does not allow remote code execution or privilege escalation, it permits data exfiltration for authenticated users who have the ability to read the logs.