Amazon Bedrock AgentCore Starter Toolkit: Code injection during agent import
Summary
The Python package bedrock-agentcore-starter-toolkit, which imports Amazon Bedrock Agents into local development environments, does not safely encode configuration values when it generates Python source code. An authenticated actor in the same AWS account can craft an agent so that arbitrary code runs when a user imports and then runs or deploys it. The toolkit is deprecated, and the attack requires user interaction.
Affected
- bedrock-agentcore-starter-toolkit from 0.1.4 up to and including 0.3.13
- Default configurations are not affected according to the CVE record.
Fixed in
- Version 0.3.14 (released on PyPI, fix announced in AWS bulletin 2026-127-AWS)
Workaround
- No technical workaround is documented by AWS.
- The toolkit has been deprecated since March 27, 2026. AWS recommends migrating to the AgentCore CLI (@aws/agentcore), which contains the equivalent fix.
- Do not run the agentcore create import or agentcore import-agent commands against Bedrock Agents whose data-plane fields may have been modified by other principals in the same account.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found.
Our recommendation
- Check on developer machines and CI runners with pip show bedrock-agentcore-starter-toolkit whether an affected version is installed.
- Upgrade to version 0.3.14 at minimum, or migrate to the AgentCore CLI (@aws/agentcore).
- Re-import agents that were imported with an affected version using 0.3.14 or later, and replace their local and deployed output artifacts, as stated by AWS.
- Restrict who can modify Bedrock Agent configurations in the AWS account.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-127-AWS aws.amazon.com
- PyPI: bedrock-agentcore-starter-toolkit 0.3.14 pypi.org
- GitHub: bedrock-agentcore-starter-toolkit pull request 586 github.com
- GitHub: bedrock-agentcore-starter-toolkit repository github.com
- EUVD-2026-94001 (vulners) vulners.com
- Vulners: CVE-2026-105812 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:34.
Original description (NVD)
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values incorporated into generated Python source without safe literal encoding. To remediate this issue, users should upgrade to version 0.3.14. Because this issue persists into generated source, upgrading alone is not sufficient: agents imported with an affected version must be re-imported with version 0.3.14 or later and their local and deployed output artifacts replaced.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.