AWS patches Bedrock AgentCore SDK flaw that leaked prompts to CloudWatch logs

Amazon Web Services published a security bulletin on July 16, 2026, detailing CVE-2026-15737, a vulnerability in the Bedrock AgentCore Python SDK. The flaw allowed sensitive content, including raw user prompts and complete agent responses, to be disclosed through OpenTelemetry spans. This issue affects developers using the open-source library to build AI agents on the Amazon Bedrock AgentCore platform.

The vulnerability stemmed from the SDK’s OpenTelemetry instrumentation, which wrote unfiltered data into span attributes on every invocation. According to the AWS Security Bulletins, these spans flowed into the customer's aws/spans CloudWatch log group. Any local authenticated user with CloudWatch Logs read access could potentially view this sensitive content. AWS classified the bulletin as important, requiring attention from users of the affected software components.

Context and Background

The Bedrock AgentCore Python SDK, known as bedrock-agentcore, provides client tools for building AI agents. The specific flaw, CVE-2026-15737, was identified in how the library handled telemetry data. Instead of filtering or masking sensitive inputs and outputs, the affected versions recorded them in plain text within the spans. This behavior meant that every interaction with the AI agent left a traceable record in the logging infrastructure.

AWS stated that the issue has been addressed in Bedrock AgentCore Python SDK version 1.5.1 or later. The company recommended that users upgrade to the latest version immediately. Additionally, AWS advised ensuring that any forked or derivative code is patched to incorporate the new fixes. This ensures that custom implementations also benefit from the security improvements provided in the official release.

Who Is Affected

Users who ran affected versions of the Bedrock AgentCore Python SDK are impacted by this disclosure. The risk applies to any environment where the SDK was used to interact with the Amazon Bedrock AgentCore platform. Specifically, the exposure occurs in the aws/spans CloudWatch log group associated with the customer's account. Any individual with read access to these logs could potentially retrieve the sensitive prompts and responses stored there.

AWS noted that no workarounds are available for this vulnerability. The only mitigation is upgrading to version 1.5.1 or later. Organizations should review their deployment pipelines to ensure all instances of the SDK are updated. Furthermore, users who ran affected versions should review and purge sensitive content from their aws/spans CloudWatch log groups to minimize the risk of data exposure.

What should you do?

Security teams should verify the version of the Bedrock AgentCore Python SDK currently in use across their infrastructure. If any instance is running a version prior to 1.5.1, it should be updated immediately to prevent further logging of sensitive data. Administrators should also audit CloudWatch Logs permissions to ensure that only authorized personnel have read access to the aws/spans log group.

What to do and how to stay safe: AWS

• Audit your Python environments to identify any installations of the Bedrock AgentCore SDK older than version 1.5.1.
• Review the aws/spans CloudWatch log group for any sensitive data that may have been logged by affected versions.
• Purge or delete logs containing raw user prompts and agent responses from the affected CloudWatch log groups.
• Update access controls for CloudWatch Logs to restrict read permissions to only those who strictly require them.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-15737?

CVE-2026-15737 is a vulnerability in the Bedrock AgentCore Python SDK that caused raw user prompts and agent responses to be written to OpenTelemetry spans without filtering.

Which versions of the SDK are affected?

All versions of the Bedrock AgentCore Python SDK prior to version 1.5.1 are affected by this sensitive content disclosure issue.

Is there a workaround for this vulnerability?

No workarounds are available; users must upgrade to Bedrock AgentCore Python SDK version 1.5.1 or later to mitigate the risk.