AWS Fixes Code Injection and SSRF Flaws in Bedrock AgentCore Toolkit
Amazon patches two vulnerabilities in its open-source Bedrock AgentCore Starter Toolkit that allowed arbitrary code execution and server-side request forgery.
Key points
- AWS addresses CVE-2026-105812, a code injection flaw enabling arbitrary execution.
- CVE-2026-106032 allows unintended network requests or local file access.
- Vulnerabilities affect Bedrock AgentCore Starter Toolkit versions 0.1.4 through 0.3.13.
Amazon Web Services has published a security bulletin addressing two vulnerabilities in its open-source Bedrock AgentCore Starter Toolkit. The advisory, released on October 6, 2026, details flaws that could allow attackers to execute arbitrary code or access local files when developers import maliciously crafted agents.
At a glance
- Publisher
- AWS Security Bulletins
- CVEs
- CVE-2026-105812, CVE-2026-106032
The primary concern is CVE-2026-105812, a code injection issue. According to the AWS Security Bulletin, this vulnerability permits arbitrary code execution if a specially crafted agent is imported and subsequently run or deployed. The second flaw, CVE-2026-106032, is an external reference handling issue. This defect can trigger unintended network requests or local file access during the agent import process. Both issues are contained within the `bedrock-agentcore-starter-toolkit`, an AWS-maintained Python package distributed via GitHub and PyPI.
Context and Background
The Bedrock AgentCore Starter Toolkit provides a command-line interface designed to help developers import Amazon Bedrock Agents into local development environments. By facilitating the transfer of agents from the cloud to local setups, the tool aims to streamline the development workflow for AI applications built on AWS infrastructure. However, the trust model inherent in importing external code introduces significant security risks if input validation is insufficient.
The identified vulnerabilities highlight the dangers of processing untrusted agent definitions. The code injection flaw (CVE-2026-105812) suggests that the toolkit previously failed to adequately sanitize or sandbox the code contained within imported agents. This allowed malicious payloads to execute on the developer's local machine or deployment environment. Similarly, the external reference handling issue (CVE-2026-106032) indicates that the toolkit did not properly restrict network calls or file system interactions initiated by the imported agent data, potentially leading to server-side request forgery (SSRF) or data exfiltration.
Who Is Affected
The vulnerabilities impact users of the `bedrock-agentcore-starter-toolkit` Python package. Specifically, versions greater than or equal to 0.1.4 and less than or equal to 0.3.13 are affected. Any developer or organization using these versions to import Bedrock Agents into their local development environments is exposed to the risks described in the bulletin. Since the package is distributed via PyPI, it is likely widely used in the AWS developer community, making the scope of exposure potentially broad.
What should you do?
AWS has classified the bulletin as "Important," requiring attention. The immediate step for affected users is to update the `bedrock-agentcore-starter-toolkit` package to a version newer than 0.3.13. Developers should audit their import processes to ensure they are not handling untrusted agent definitions without verification. Until an update is applied, users should avoid importing agents from unverified sources to mitigate the risk of code injection and unauthorized file or network access.
What to do and how to stay safe: AWS
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the CVE IDs for the Bedrock AgentCore vulnerabilities?
The vulnerabilities are identified as CVE-2026-105812 and CVE-2026-106032.
Which versions of the toolkit are vulnerable?
Versions 0.1.4 through 0.3.13 are affected by these issues.
What can an attacker do with these flaws?
An attacker can execute arbitrary code or trigger unintended network requests and local file access.
