CVE-2026-105812
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore…
- Risk score
- 58/100
- CVSS
- 9.0 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values incorporated into generated…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.3.14 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 9.0 critical
References
Original description
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values incorporated into generated Python source without safe literal encoding. To remediate this issue, users should upgrade to version 0.3.14. Because this issue persists into generated source, upgrading alone is not sufficient: agents imported with an affected version must be re-imported with version 0.3.14 or later and their local and deployed output artifacts replaced.
Last activity 6 Oct 2026. Patch Forecast updates every hour.