CVE-2026-12530: AWS Bedrock AgentCore SDK Command Injection – Exploit Details & Patch Guidance

Technical summary

The install_packages() method in AWS Bedrock AgentCore Python SDK fails to properly neutralize argument delimiters in package name inputs (CWE-88: Argument Injection). This allows remote authenticated attackers to break out of the intended package installation context and execute arbitrary system commands within the Code Interpreter sandbox. The vulnerability requires user interaction (likely clicking or approving a malicious operation) and affects all versions from 1.1.3 up to but not including 1.6.1.

Business impact

Organizations using the AWS Bedrock AgentCore Python SDK for autonomous agent workloads face risk of unauthorized code execution within their agent environments. This could lead to exfiltration of sensitive data processed by agents, modification of agent behavior, lateral movement to other AWS resources if the Code Interpreter has inherited IAM permissions, and disruption of AI-driven applications relying on Bedrock agents. The impact is elevated for customers using agents in multi-tenant or shared compute scenarios.

Affected systems

AWS Bedrock AgentCore Python SDK versions 1.1.3 through 1.6.0 are affected. Organizations should audit their Python environments and dependency manifests to identify if this SDK is pinned to a vulnerable version. The vulnerability only impacts code paths that call install_packages() with user-controlled or insufficiently validated package name inputs.

Exploitability

Exploitation requires valid AWS credentials (authentication), user interaction to trigger the malicious operation, and knowledge of the install_packages() method signature. The attack surface is moderate: an attacker cannot exploit this unauthenticated or without some form of social engineering to prompt a user to install a crafted package. The network vector is straightforward, and the vulnerability does not require complex setup or privileged access to the underlying infrastructure.

Remediation

Upgrade AWS Bedrock AgentCore Python SDK to version 1.6.1 or later immediately. Review any agent implementations that dynamically construct package names from external input and implement input validation as a defense-in-depth measure. Consider restricting Code Interpreter sandbox permissions at the IAM level to limit the blast radius of command execution.

Patch guidance

Update the AWS Bedrock AgentCore Python SDK dependency to version 1.6.1 or higher. Verify the upgrade by checking the installed version with `pip show aws-bedrock-agentcore` and confirming it reports 1.6.1 or above. If using version pinning in requirements.txt or pyproject.toml, update the constraint from `==1.x.x` to `>=1.6.1`. Test in a non-production environment before rolling out to production agents. No breaking changes are documented between 1.6.0 and 1.6.1 based on AWS release notes; update with confidence.

Detection guidance

Monitor CloudTrail logs for install_packages() API calls originating from Bedrock agents, especially those with unusual package names containing special characters, semicolons, pipes, or backticks. Implement guardrails within agent definitions to whitelist allowed packages and reject dynamic package name construction. Use AWS Config rules to enforce SDK version compliance across your Bedrock agent deployments. Review Code Interpreter execution logs for anomalous system commands that don't correspond to legitimate agent workflows.

Why prioritize this

This vulnerability merits urgent patching due to its HIGH CVSS score (7.3), the authenticated but easily satisfied user-interaction requirement, and the broad reach of AWS Bedrock across organizations deploying AI agents. The combination of high confidentiality and integrity impact, relatively low complexity for an attacker with valid credentials, and the prevalence of dynamic agent workloads elevates risk. While not yet in CISA's KEV catalog, the technical severity and active exploitation likelihood justify immediate remediation.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects: (1) Network-accessible attack vector—exploitable remotely; (2) Low attack complexity—no special conditions beyond authentication; (3) Low privilege requirement—only authenticated users, which may be internal developers or external partners; (4) User interaction required—a human must trigger the install_packages() call; (5) High confidentiality and integrity impact—code execution can read and modify data; (6) No availability impact—the vulnerability does not cause denial of service. The score does not account for organizational context; assess your own Code Interpreter sandbox permissions and agent user base to determine if risk is higher or lower.

Frequently asked questions