AWS Bedrock AgentCore SDK Sensitive Data Exposure via OpenTelemetry Span Logging
First seen Jul 16, 2026 · Updated Jul 16, 2026 · CVSS 5.7
AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 logged raw user prompts and full agent responses into OpenTelemetry span attributes without any filtering or masking, which then flowed into customer CloudWatch aws/spans log groups. Any principal with read access to those logs could view sensitive user content, including secrets or PII that may have been part of prompts or agent outputs. This is a data exposure issue rather than an active exploit, and requires local/authenticated access to the customer's own logging infrastructure.
Technical Analysis
The SDK's OpenTelemetry instrumentation captured complete, unredacted user prompts and agent responses as span attributes on every agent invocation, with no sanitization, PII masking, or opt-out mechanism. These spans were automatically shipped to the customer's aws/spans CloudWatch log group, meaning sensitive data present in prompts (credentials, PII, proprietary business data) or in agent-generated responses was persisted in plaintext logs. The entry point is normal agent invocation traffic; no attacker action is needed to trigger logging, but any authenticated principal with CloudWatch log read permissions (including over-privileged IAM roles, third-party log aggregators, or compromised internal accounts) can retrieve this data. This crosses a trust boundary between the agent runtime and observability/logging infrastructure, effectively turning telemetry data into an unintended sensitive-data exfiltration channel.
Affected Systems
AWS Bedrock AgentCore Python SDK
Detection Signatures
- Review aws/spans CloudWatch log group entries for span attributes containing full prompt/response text
- Check AgentCore SDK version in dependency manifests for 1.4.8 or 1.5.0
- Audit IAM policies for principals with broad CloudWatch Logs read access (logs:GetLogEvents, logs:FilterLogEvents) on aws/spans log groups
- Look for OpenTelemetry span exporters configured without attribute redaction/sanitization filters
Remediation Steps
- 1
Upgrade SDK
Upgrade AWS Bedrock AgentCore Python SDK to version 1.5.1 or later, which addresses the unfiltered span logging issue.
- 2
Purge exposed logs
Review and purge or redact sensitive content already written to aws/spans CloudWatch log groups from affected versions.
- 3
Restrict log access
Apply least-privilege IAM policies restricting CloudWatch Logs read access on aws/spans log groups to only necessary principals.
- 4
Enable log encryption and retention controls
Ensure CloudWatch log groups use KMS encryption and set appropriate retention/expiration policies to limit exposure window.
- 5
Implement telemetry sanitization
Configure or verify OpenTelemetry exporters apply PII/secret redaction or masking on span attributes before export, going forward.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.