Key points
- AWS Bedrock AgentCore Python SDK versions prior to 1.5.1 leaked raw prompts and responses to CloudWatch logs.
- The flaw, tracked as CVE-2026-15737, allowed any user with read access to view sensitive agent interactions.
- Amazon released version 1.5.1 to fix the issue and advises purging affected log groups.
Amazon Web Services published a security bulletin on July 16, 2026, addressing a data disclosure flaw in its Bedrock AgentCore Python SDK. The vulnerability, identified as CVE-2026-15737, affected OpenTelemetry instrumentation within the library. According to the advisory, affected versions wrote unfiltered user prompts and complete agent responses into span attributes during every invocation.
These spans were subsequently stored in the customer’s aws/spans CloudWatch log group. Any local authenticated user possessing CloudWatch Logs read access could retrieve this sensitive content. The issue has been resolved in SDK version 1.5.1. AWS recommends upgrading immediately and purging historical logs that may contain exposed data.
By the numbers
- 1.5.1 is the first version of the Bedrock AgentCore Python SDK that fixes the data leak.
- CVE-2026-15737 is the identifier for the sensitive content disclosure flaw in OpenTelemetry spans.
- 07/16/2026 is the publication date of the AWS security bulletin regarding this issue.
What the figures mean
The release of version 1.5.1 marks the end of the vulnerability window for organizations using the Bedrock AgentCore Python SDK. Before this update, the SDK’s integration with OpenTelemetry failed to mask sensitive inputs and outputs. This design flaw meant that every interaction with an AI agent generated log entries containing raw text. For managed service providers, this creates a significant risk if clients share log access or if internal staff have broad permissions. The CVE ID confirms this is a tracked security defect requiring immediate attention from development and operations teams.
What should you do?
Organizations must verify their current SDK versions against the fixed release. If you are running versions older than 1.5.1, you should initiate an upgrade process for all affected applications. Additionally, review permissions for CloudWatch Logs to ensure only necessary personnel have read access to the aws/spans log group. Conduct a log purge operation to remove sensitive prompts and responses that were recorded before the patch. Monitor your systems for any unusual access patterns in the logs following the update.
Operational impact
Teams usually need to coordinate between development, security, and operations when addressing SDK-level leaks. Check whether any forked or derivative code exists that bypasses standard package updates. Determine who inside the organization has access to CloudWatch Logs and restrict those permissions. Inform stakeholders about the potential exposure of sensitive AI interactions. Establish a process for regular log audits to catch similar issues early. Ensure that all environments, including development and staging, are patched to prevent further data accumulation.
What to do and how to stay safe: AWS
- Upgrade Bedrock AgentCore Python SDK to version 1.5.1 or later on all systems.
- Review and purge sensitive content from aws/spans CloudWatch log groups.
- Ensure any forked or derivative code incorporates the new fixes.
- Audit CloudWatch Logs permissions to restrict read access to necessary users.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AWS service is affected by CVE-2026-15737?
The Bedrock AgentCore Python SDK is affected, specifically regarding its OpenTelemetry instrumentation.
Is there a workaround for this vulnerability?
No workarounds are available; users must upgrade to SDK version 1.5.1 or later.
Who can access the leaked data in CloudWatch logs?
Any local authenticated user with CloudWatch Logs read access could access the content.
