VAITP Dataset

← Back to the dataset

CVE-2026-15737

AWS Bedrock SDK insecurely logs sensitive user data to CloudWatch logs.

  • CVSS 5.7
  • CWE-532
  • Information Leakage
  • Local

AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. Unintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 might allow a local authenticated user with access to CloudWatch Logs to access raw user prompts and agent responses containing sensitive data via span attributes. The SDK wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, exposing sensitive content to any principal with log read access. We recommend you upgrade to version 1.5.1 or later. Users who ran affected versions should also review and purge sensitive content from their aws/spans CloudWatch log groups.

CVE
CVE-2026-15737
CWE
CWE-532
CVSS base score
5.7
Published
2026-07-16
OWASP
A09 Security Logging and Monitoring Failures
Orthogonal defect classification
Checking
Code defect classification
Missing Check
Category
Information Leakage
Subcategory
Insecure Handling of Sensitive Data
Accessibility scope
Local
Impact
Information Disclosure
Affected component
AWS Bedrock
Fixed by upgrading
Yes

Solution

Upgrade to version 1.5.1 or later.

Vulnerable code sample

# A representative code example for a vulnerability pattern similar to the one described.
# This code simulates a vulnerable behavior where sensitive data is logged to spans.

from opentelemetry import trace
from opentelemetry.sdk.trace import TracerProvider
from opentelemetry.sdk.trace.export import ConsoleSpanExporter, SimpleSpanProcessor

# --- 1. Setup OpenTelemetry to print spans to the console ---
# This simulates the SDK sending telemetry data to a logging backend like AWS CloudWatch Logs.
provider = TracerProvider()
provider.add_span_processor(SimpleSpanProcessor(ConsoleSpanExporter()))
trace.set_tracer_provider(provider)
tracer = trace.get_tracer("vulnerable.sdk")


def invoke_agent_vulnerable(prompt: str):
    """
    Simulates a vulnerable function from an SDK that incorrectly logs
    sensitive data to OpenTelemetry spans during an agent invocation.
    """
    with tracer.start_as_current_span("agent.invoke") as span:
        # Simulate agent processing to generate a response.
        agent_response = "This is the agent's full response to your query about the secret key."

        # VULNERABILITY: Raw user prompt is written to a span attribute
        # without any masking or filtering. This data would be visible in logs.
        span.set_attribute("agent.prompt", prompt)

        # VULNERABILITY: The complete agent response is also written
        # to a span attribute, potentially exposing sensitive data it contains.
        span.set_attribute("agent.response", agent_response)

        return agent_response


# --- 2. Trigger the vulnerable function with sensitive data ---
if __name__ == "__main__":
    sensitive_user_prompt = "My API key is 'sk-12345-abcdef-ghijkl-mnopqr' and my password is 'Password123!'. Please use it to access my account."

    # When this function is called, the OpenTelemetry exporter will automatically
    # print the full span to the console. The output will clearly show the
    # 'attributes' dictionary containing the unmasked sensitive prompt and response.
    invoke_agent_vulnerable(prompt=sensitive_user_prompt)

Patched code sample

def _add_attributes_to_span(span, prompt_text, response_text, session_id):
    """
    Represents the fixed OpenTelemetry instrumentation logic for an agent invocation.

    In the vulnerable version, the raw 'prompt_text' and 'response_text' were
    unconditionally added as span attributes, leaking sensitive data to logs.

    The fix is to stop logging this sensitive content.
    """
    # Log non-sensitive metadata, such as a session ID, which is safe.
    if session_id:
        span.set_attribute("bedrock.agent.session_id", session_id)

    # FIX: Instead of logging the raw prompt and response, we now only log their
    # lengths. This provides useful metrics for observability (e.g., performance
    # analysis) without exposing the potentially sensitive content.
    span.set_attribute("bedrock.agent.prompt.length", len(prompt_text))
    span.set_attribute("bedrock.agent.response.length", len(response_text))

    # The following lines, which existed in the vulnerable versions (1.4.8, 1.5.0),
    # have been removed in the fixed version (1.5.1+) to prevent data leakage:
    #
    # span.set_attribute("bedrock.agent.prompt", prompt_text)
    # span.set_attribute("bedrock.agent.response", response_text)

Cite this entry

@misc{vaitp:cve202615737,
  title        = {{AWS Bedrock SDK insecurely logs sensitive user data to CloudWatch logs.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-15737},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-15737/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::