CVE-2026-105812 in Bedrock AgentCore Starter Toolkit
Summary
by MITRE • 10/07/2026
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values incorporated into generated Python source without safe literal encoding.
To remediate this issue, users should upgrade to version 0.3.14. Because this issue persists into generated source, upgrading alone is not sufficient: agents imported with an affected version must be re-imported with version 0.3.14 or later and their local and deployed output artifacts replaced.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Amazon Bedrock AgentCore Starter Toolkit prior to version 0.3.14 represents a critical failure in input validation and data sanitization within the agent import functionality, specifically classified under CWE-95 as Improper Neutralization of Special Elements used in an OS Command or Code Injection. This flaw allows for arbitrary code execution by exploiting how configuration values are processed during the generation of Python source code artifacts. When an authenticated actor operating within the same AWS account imports a Bedrock Agent using this toolkit, the system incorporates user-supplied configuration parameters directly into the generated Python scripts without applying safe literal encoding or proper escaping mechanisms. This lack of sanitization creates a direct pathway for injection attacks, where maliciously crafted input strings can break out of their intended context and be interpreted as executable code by the underlying runtime environment.
The operational impact of this vulnerability is severe, granting an authenticated same-account actor the ability to execute arbitrary commands on the infrastructure hosting the Bedrock Agent or within the execution container associated with the agent's deployment. Because the toolkit generates Python source files that are subsequently run or deployed, any unsanitized input embedded in these configurations becomes part of the executable logic. An attacker can leverage this by providing configuration values containing shell metacharacters, Python syntax injections, or other payload structures designed to bypass existing security controls. This effectively compromises the integrity and confidentiality of the AWS account environment, potentially leading to data exfiltration, lateral movement within the network, or complete system compromise depending on the privileges granted to the agent's execution role.
This issue is further complicated by its persistence in generated source code artifacts, meaning that a simple software upgrade does not retroactively fix agents already imported with vulnerable versions of the toolkit. The malicious logic becomes embedded in the static Python files produced during previous import operations. Consequently, remediation requires more than just updating the Bedrock AgentCore Starter Toolkit to version 0.3.14 or later. Users must actively re-import all affected agents using the patched version to regenerate the source code with proper sanitization applied. Additionally, it is imperative that any local development artifacts and deployed output files associated with these agents are replaced with those generated by the updated toolkit to ensure that no residual vulnerable configurations remain in production environments.
From a defensive posture perspective, this vulnerability underscores the importance of strict input validation and secure coding practices when generating dynamic code from user inputs. Security teams should implement rigorous testing procedures for any tooling involved in agent configuration management, ensuring that all external data is treated as untrusted until proven safe. Adherence to industry standards such as CWE-79 for Cross-site Scripting principles applied to server-side generation and OWASP guidelines for input validation can help prevent similar issues. Furthermore, organizations should enforce least privilege principles on IAM roles associated with Bedrock Agents to limit the blast radius in case of a successful exploitation attempt, ensuring that even if arbitrary code is executed, it cannot escalate privileges or access sensitive resources beyond its designated scope.