{"id":"GHSA-37r5-8xpw-vxp9","kind":"vulnerability","aliases":["GHSA-37r5-8xpw-vxp9"],"related":[],"title":"CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF","description":"CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF\n\n### CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF\n\nBulletin ID: 2026-127-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/06/2026 13:30 PM PDT\n\nDescription:\n\nbedrock-agentcore-starter-toolkit is an AWS-maintained open-source Python package, distributed via GitHub and PyPI, that provides a command-line interface for importing Amazon Bedrock Agents into local development environments. We identified CVE-2026-105812, a code injection issue that could allow arbitrary code execution when a specially crafted agent is imported and subsequently run or deployed, and CVE-2026-106032, an external reference handling issue that could cause unintended network requests or local file access during agent import.\n\nAffected versions: >= 0.1.4 and <= 0.3.13\n\nResolution:\n\nThis issue has been addressed in bedrock-agentcore-starter-toolkit version 0.3.14. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Agents imported with an affected version must be re-imported with version 0.3.14 or later and their local and deployed output artifacts replaced.\n\nWorkarounds:\n\nbedrock-agentcore-starter-toolkit has been deprecated as of March 27, 2026. Customers who have not yet migrated can avoid unintended disclosure by refraining from running the agentcore create import or agentcore import-agent commands against Bedrock Agents whose data-plane fields may have been modified by other principals in the same account. The recommended long-term action is to migrate to the replacement tooling, AgentCore CLI (@aws/agentcore), which contains the equivalent fix for the same issue class.\n\nReferences:\n\n- CVE-2026-105812\n- CVE-2026-106032\n- GHSA-37r5-8xpw-vxp9\n- GHSA-5xmr-2rcp-3j75\n\nAcknowledgement:\n\nWe would like to thank Koh Jun Sheng for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The bedrock-agentcore-starter-toolkit Python CLI, used to import Amazon Bedrock Agents locally, has a code injection flaw (CVE-2026-105812) that can run arbitrary code when a crafted agent is imported and then run or deployed. A second flaw (CVE-2026-106032) lets an import trigger unintended network requests or local file access.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agentcore","aws","bedrock","lab-disclosure","package","python","self-hosted"],"not_affected_if":["not-using-import-command","version-outside-range"],"how_to_check":"- Check the installed version with `pip show bedrock-agentcore-starter-toolkit`, affected versions are `>= 0.1.4` and `<= 0.3.13`\n- Look for `agentcore create import` or `agentcore import-agent` in scripts and CI jobs\n- Check whether any forked or derivative copy of the toolkit is in use","fix":"- Upgrade `bedrock-agentcore-starter-toolkit` to `0.3.14` or later\n- Re-import every agent that was imported with an affected version and replace its local and deployed output artifacts\n- Migrate to the replacement AgentCore CLI (`@aws/agentcore`), which the bulletin says contains the equivalent fix","status":"open","published_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","triaged_at":"2026-10-25T04:51:42+00:00","updated_at":"2026-10-25T04:51:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:51:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `bedrock-agentcore-starter-toolkit` to `0.3.14` or later\n- Re-import every agent that was imported with an affected version and replace its local and deployed output artifacts\n- Migrate to the replacement AgentCore CLI (`@aws/agentcore`), which the bulletin says contains the equivalent fix","reach":"local","title":"AWS AgentCore Starter Toolkit: crafted agent import allows code execution","impact":"high","summary":"The bedrock-agentcore-starter-toolkit Python CLI, used to import Amazon Bedrock Agents locally, has a code injection flaw (CVE-2026-105812) that can run arbitrary code when a crafted agent is imported and then run or deployed. A second flaw (CVE-2026-106032) lets an import trigger unintended network requests or local file access.","category":"package","nicknames":[],"who_cares":["python","aws","bedrock","agentcore","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Arbitrary code runs on the developer machine when a crafted agent is imported.","analyst_note":"Check the AWS bulletin 2026-127-AWS and GHSA-37r5-8xpw-vxp9 for attacker preconditions and whether the deprecated toolkit has a published exploit path.","how_to_check":"- Check the installed version with `pip show bedrock-agentcore-starter-toolkit`, affected versions are `>= 0.1.4` and `<= 0.3.13`\n- Look for `agentcore create import` or `agentcore import-agent` in scripts and CI jobs\n- Check whether any forked or derivative copy of the toolkit is in use","needs_analyst":true,"not_affected_if":["not-using-import-command","version-outside-range"],"who_is_affected":"Teams that run the agentcore import commands against Amazon Bedrock Agents using the Python toolkit at versions 0.1.4 through 0.3.13, including forks of it. The bulletin's workaround points to Bedrock Agents whose data-plane fields other principals in the same account may have changed. Teams that never used the import commands or that run versions outside the range can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00081,"input_tokens":4148,"output_tokens":791,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105812':3A,63B,99C,118C,195C,390C '-106032':7A,85B,103C,122C,221C,393C '-127':138C '-2026':2A,6A,62B,84B,98C,102C,117C,121C,194C,220C,389C,392C '0.1.4':242C '0.3.13':244C '0.3.14':258C,293C '10/06/2026':149C '13':150C '2026':137C,317C '27':316C '2rcp':402C '30':151C '37r5':22A,27A,396C '3j75':403C '5xmr':401C '8xpw':23A,28A,397C 'access':96B,236C 'account':360C 'acknowledg':404C 'action':366C 'address':250C 'affect':240C,284C 'agent':15A,54B,72B,111C,130C,186C,210C,238C,280C,340C,344C 'agentcor':11A,30B,44B,107C,126C,157C,254C,307C,333C,337C,374C 'allow':202C 'amazon':52B,184C 'arbitrari':67B,203C 'artifact':302C 'attent':146C 'avoid':325C 'aw':31B,139C,141C,163C 'aws-maintain':162C 'aws-security@amazon.com':426C 'aws/agentcore':376C 'bedrock':10A,32B,43B,53B,106C,125C,156C,185C,253C,306C,343C 'bedrock-agentcore-starter-toolkit':42B,155C,252C,305C 'bulletin':135C 'caus':229C 'class':386C 'cli':48B,375C 'code':16A,58B,68B,112C,131C,197C,204C,272C 'collabor':414C 'command':179C,341C 'command-lin':178C 'concern':432C 'contain':378C 'content':142C 'coordin':420C 'could':201C,228C 'craft':71B,209C 'creat':334C 'custom':318C 'cve':1A,5A,61B,83B,97C,101C,116C,120C,193C,219C,388C,391C 'data':347C 'data-plan':346C 'date':148C 'deploy':79B,217C,300C 'deprec':312C 'deriv':271C 'descript':154C 'develop':189C 'disclosur':35B,327C,422C 'distribut':170C 'email':425C 'ensur':267C 'environ':190C 'equival':380C 'execut':205C 'extern':223C 'field':349C 'file':95B,235C 'fix':279C,381C 'flaw':60B,82B 'fork':269C 'ghsa':21A,26A,395C,400C 'ghsa-37r5-8xpw-vxp9':20A,25A,394C 'ghsa-5xmr-2rcp-3j75':399C 'github':172C 'handl':225C 'host':40B 'id':136C 'identifi':192C 'import':14A,51B,74B,88B,110C,129C,144C,183C,212C,239C,281C,290C,335C,339C 'import-ag':338C 'incorpor':276C 'inject':17A,59B,113C,132C,198C 'interfac':181C 'issu':8A,104C,123C,199C,226C,247C,385C,417C 'jun':411C 'koh':410C 'lab':34B 'lab-disclosur':33B 'later':295C 'latest':264C 'let':86B 'like':407C 'line':180C 'local':55B,94B,188C,234C,298C 'long':364C 'long-term':363C 'maintain':164C 'march':315C 'may':350C 'migrat':323C,369C 'modifi':353C 'must':286C 'network':91B,231C 'new':278C 'open':166C 'open-sourc':165C 'output':301C 'packag':36B,169C 'patch':274C 'pdt':153C 'plane':348C 'pleas':424C 'pm':152C 'princip':356C 'process':423C 'provid':176C 'public':147C 'pypi':174C 'python':37B,47B,168C 'question':430C 're':289C 're-import':288C 'recommend':260C,362C 'refer':224C,387C 'refrain':329C 'replac':303C,372C 'request':92B,232C 'requir':145C 'resolut':245C 'run':66B,77B,215C,331C 'scope':140C 'second':81B 'secur':429C 'self':39B 'self-host':38B 'sheng':412C 'sourc':167C 'special':208C 'ssrf':19A,115C,134C 'starter':12A,45B,108C,127C,158C,255C,308C 'subsequ':214C 'term':365C 'thank':409C 'tool':373C 'toolkit':13A,46B,109C,128C,159C,256C,309C 'trigger':89B 'type':143C 'unintend':90B,230C,326C 'upgrad':261C 'use':49B 'version':241C,257C,265C,285C,292C 'via':171C 'vulner':421C 'vxp9':24A,29A,398C 'whose':345C 'workaround':304C 'would':406C 'yet':322C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the agentcore import commands against Amazon Bedrock Agents using the Python toolkit at versions 0.1.4 through 0.3.13, including forks of it. The bulletin's workaround points to Bedrock Agents whose data-plane fields other principals in the same account may have changed. Teams that never used the import commands or that run versions outside the range can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-127-aws/#GHSA-37r5-8xpw-vxp9","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-127-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"AWS: CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF"}],"documents":[{"id":2888,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-127-aws/","title":"AWS: CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF","kind":"advisory","source":"lab","text":"CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF\n\n### CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF\n\nBulletin ID: 2026-127-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/06/2026 13:30 PM PDT\n\nDescription:\n\nbedrock-agentcore-starter-toolkit is an AWS-maintained open-source Python package, distributed via GitHub and PyPI, that provides a command-line interface for importing Amazon Bedrock Agents into local development environments. We identified CVE-2026-105812, a code injection issue that could allow arbitrary code execution when a specially crafted agent is imported and subsequently run or deployed, and CVE-2026-106032, an external reference handling issue that could cause unintended network requests or local file access during agent import.\n\nAffected versions: >= 0.1.4 and <= 0.3.13\n\nResolution:\n\nThis issue has been addressed in bedrock-agentcore-starter-toolkit version 0.3.14. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Agents imported with an affected version must be re-imported with version 0.3.14 or later and their local and deployed output artifacts replaced.\n\nWorkarounds:\n\nbedrock-agentcore-starter-toolkit has been deprecated as of March 27, 2026. Customers who have not yet migrated can avoid unintended disclosure by refraining from running the agentcore create import or agentcore import-agent commands against Bedrock Agents whose data-plane fields may have been modified by other principals in the same account. The recommended long-term action is to migrate to the replacement tooling, AgentCore CLI (@aws/agentcore), which contains the equivalent fix for the same issue class.\n\nReferences:\n\n- CVE-2026-105812\n- CVE-2026-106032\n- GHSA-37r5-8xpw-vxp9\n- GHSA-5xmr-2rcp-3j75\n\nAcknowledgement:\n\nWe would like to thank Koh Jun Sheng for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}