CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
CVE-2026-119115
Summary
Bulletin ID: 2026-154-AWS
Publication Date: 10/28/2026 12:30 PM PDT
Description:
We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language model (LLM) through its tool schema. A crafted prompt, delivered through content the agent is asked to process, could instruct the model to call the tool with masking turned off.
The tool would then return the agent host's environment variables in cleartext, including cloud credentials and API keys, without prompting the operator for consent.
Impacted versions: >= 0.1.0 AND < 0.8.6
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.