CVE-2026-105812— Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import
Quick assessment
Affected
aws bedrock-agentcore-starter-toolkit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Amazon Bedrock AgentCore Starter Toolkit 0.3.14 之前的版本中，代理导入功能存在代码生成控制不当的问题。该漏洞可能允许经过认证且属于同一账户的攻击者，通过导入并运行或部署 Amazon Bedrock Agent，在生成的 Python 源代码中嵌入精心构造的配置值（未进行安全字面量编码），从而执行任意代码。 要解决此问题，用户应将系统升级至版本 0.3.14。由于漏洞影响会延续到生成的源代码中，仅升级软件版本是不够的：必须使用版本 0.3.14 或更高版本重新导入
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105812
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import
Source: CVE Program / CVE List V5
Vulnerability Description
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values incorporated into generated Python source without safe literal encoding.
To remediate this issue, users should upgrade to version 0.3.14. Because this issue persists into generated source, upgrading alone is not sufficient: agents imported with an affected version must be re-imported with version 0.3.14 or later and their local and deployed output artifacts replaced.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| aws | bedrock-agentcore-starter-toolkit | 0.1.4 ~ 0.3.13 | - |
|
II. Public POCs for CVE-2026-105812
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105812
请登录查看更多情报信息。
Other References for CVE-2026-105812 (2)
-
-
https://aws.amazon.com/security/security-bulletins/2026-127-aws/ vendor-advisory
Same Patch Batch · aws · 2026-10-06 · 3 CVEs total
| CVE-2026-105811 | 6.5 MEDIUM | Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sa |
| CVE-2026-106032 | 5.7 MEDIUM | Server-side request forgery and local file read via unrestricted external OpenAPI referenc |
IV. Related Vulnerabilities
Same vendor: aws
-
CVE-2026-106032
Server-side request forgery and local file read via unrestri -
CVE-2026-105811
Authorization bypass through a user-controlled key in the Am -
CVE-2026-104019
OS command injection in the Studio Space startup validation -
CVE-2026-103958
Server-side request forgery in the tool server and remote ag -
CVE-2026-103957
Server-side request forgery in the OAuth2 discovery handling
Same weakness: CWE-94
-
CVE-2026-106446
Handlebars: JavaScript Injection via AST Type Confusion in c -
CVE-2026-106441
Hydra logging configuration permits unsafe callable resoluti -
CVE-2026-106416
Google Chrome <155.0.8059.39 扩展程序代码注入漏洞 -
CVE-2026-106189
Chrome <155.0.8059.39 iOS 代码注入漏洞 -
CVE-2026-105858
Payload: Remote Code Execution through first-register
V. Comments for CVE-2026-105812
No comments yet