---
id: "CVE-2026-106032"
kind: "vulnerability"
aliases: ["CVE-2026-106032"]
title: "AWS AgentCore Starter Toolkit: agent import can make unintended network requests"
severity: "medium"
cvss: 5.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["agentcore", "aws", "bedrock", "lab-disclosure", "package", "python"]
not_affected_if: ["no-agent-import", "versions-outside-range"]
published_at: "2026-10-06T21:17:04+00:00"
first_seen_at: "2026-10-24T18:43:45+00:00"
updated_at: "2026-10-25T04:10:31+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-127-aws/", "first_seen_at": "2026-10-24T18:43:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106032", "first_seen_at": "2026-10-24T18:53:56+00:00"}]
---

# AWS AgentCore Starter Toolkit: agent import can make unintended network requests

The bedrock-agentcore-starter-toolkit Python package mishandles external references in an OpenAPI schema when importing a Bedrock Agent, causing unintended network requests or local file reads during import. An attacker who can modify a Bedrock Agent's data-plane fields in the same account can make a developer's import run reach internal endpoints or local files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show bedrock-agentcore-starter-toolkit` and look for a version from `0.1.4` up to `0.3.13`.
- Look for uses of `agentcore create import` or `agentcore import-agent` in scripts and CI.

## Fix

- Upgrade `bedrock-agentcore-starter-toolkit` to `0.3.14` or later.
- Re-import any agents imported with an affected version and replace their local and deployed output artifacts.
- Migrate to the AgentCore CLI (`@aws/agentcore`), which the bulletin says carries the equivalent fix.

## Timeline

- 2026-10-24T18:43:45+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-127-aws/ — AWS: CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF
- 2026-10-24T18:53:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106032

## Documents

- [advisory] AWS: CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF https://aws.amazon.com/security/security-bulletins/rss/2026-127-aws/

## From the sources

CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF

### CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF

Bulletin ID: 2026-127-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/06/2026 13:30 PM PDT

Description:

bedrock-agentcore-starter-toolkit is an AWS-maintained open-source Python package, distributed via GitHub and PyPI, that provides a command-line interface for importing Amazon Bedrock Agents into local development environments. We identified CVE-2026-105812, a code injection issue that could allow arbitrary code execution when a specially crafted agent is imported and subsequently run or deployed, and CVE-2026-106032, an external reference handling issue that could cause unintended network requests or local file access during agent import.

Affected versions: >= 0.1.4 and <= 0.3.13

Resolution:

This issue has been addressed in bedrock-agentcore-starter-toolkit version 0.3.14. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Agents imported with an affected version must be re-imported with version 0.3.14 or later and their local and deployed output artifacts replaced.

Workarounds:

bedrock-agentcore-starter-toolkit has been deprecated as of March 27, 2026. Customers who have not yet migrated can avoid unintended disclosure by refraining from running the agentcore create import or agentcore import-agent commands against Bedrock Agents whose data-plane fields may have been modified by other principals in the same account. The recommended long-term action is to migrate to the replacement tooling, AgentCore CLI (@aws/agentcore), which contains the equivalent fix for the same issue class.

References:

- CVE-2026-105812
- CVE-2026-106032
- GHSA-37r5-8xpw-vxp9
- GHSA-5xmr-2rcp-3j75

Acknowledgement:

We would like to thank Koh Jun Sheng for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_