// Security Advisory Triage

Code injection and SSRF in AWS Bedrock agent toolkit versions 0.1.4-0.3.13

AWS security bulletins · published 2026-10-07 13:27 UTC

ACTION NEEDED VERIFY_EXPOSURE SECURITYAPI

WHAT CHANGEDAWS published CVE-2026-105812 and CVE-2026-106032 on 6 October 2026 affecting bedrock-agentcore-starter-toolkit versions 0.1.4 through 0.3.13. CVE-2026-105812 allows arbitrary code execution when importing and running a malicious Bedrock agent. CVE-2026-106032 allows unintended network requests or local file access during agent import.

WHY IT MATTERSIf you import Bedrock agents into local development environments using this toolkit, a compromised or malicious agent definition can execute arbitrary code on developer machines or CI/CD runners, or exfiltrate data through SSRF. This affects the supply chain between AWS Bedrock and your development infrastructure.

WHAT TO DOCheck whether bedrock-agentcore-starter-toolkit appears in your Python dependencies or developer tooling (pip list | grep bedrock-agentcore-starter-toolkit). If you are running any version from 0.1.4 to 0.3.13, update to the patched version referenced in the AWS bulletin or remove the package until you can verify the fix.

Model-reported confidence 95% (not measured accuracy) Primary source ↗ written by anthropic/claude-sonnet-4.5

Show the reasoning — raw diff, triage verdict, confidence

RAW DIFF

+## CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF
+https://aws.amazon.com/security/security-bulletins/rss/2026-127-aws/
+Tue, 06 Oct 2026 20:41:24 +0000
+
+Bulletin ID: 2026-127-AWS
+
+Scope: AWS
+
+Content Type: Important (requires attention)
+
+Publication Date: 10/06/2026 13:30 PM PDT
+Description:
+bedrock-agentcore-starter-toolkit is an AWS-maintained open-source Python package, distributed via GitHub and PyPI, that provides a command-line interface for importing Amazon Bedrock Agents into local development environments. We identified CVE-2026-105812, a code injection issue that could allow arbitrary code execution when a specially crafted agent is imported and subsequently run or deployed, and CVE-2026-106032, an external reference handling issue that could cause unintended network requests or local file access during agent import.
+Affected versions: >= 0.1.4 and <= 0.3.13
+Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

HOW IT WAS JUDGED

Triage signals below are model-reported assertions, preserved verbatim; they are not independent arithmetic verification.

triage verdict	MATERIAL at 0.95, needed 0.55
triage reasoning	AWS Bedrock SDK with code injection and SSRF vulnerabilities affecting agent import workflows.
signals	AWS-maintained Python package in dependency tree · code injection vulnerability enabling arbitrary code execution · SSRF vulnerability enabling unintended network/file access · affects AI provider SDK (Bedrock agent toolkit) · affects developer tools and local environments · specific affected version range identified · new security bulletin publication
suppression	—
triage model	anthropic/claude-haiku-4.5 ($0.00000)
writer model	anthropic/claude-sonnet-4.5 ($0.00000)