CVE-2026-105812
Executive Summary
CVE-2026-105812 is a high-severity improper code generation vulnerability in the Amazon Bedrock AgentCore Starter Toolkit, affecting versions prior to 0.3.14. An authenticated actor within the same AWS account can inject crafted configuration values into the agent import functionality, causing malicious Python source to be generated that leads to arbitrary code execution. The vulnerability carries a critical CVSS score of 9.0, reflecting high impacts on confidentiality, integrity, and availability across changed scope, representing a severe risk to agent deployments and broader cloud environments.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
The Amazon Bedrock AgentCore Starter Toolkit provides tooling for importing, running, and deploying Bedrock Agents. The vulnerability resides in the agent import functionality, specifically in how configuration values are incorporated into generated Python source code. The toolkit fails to perform safe literal encoding when embedding user-supplied or actor-supplied configuration values into generated source. This falls under CWE-94 (Improper Control of Generation of Code), commonly referred to as "Code Injection."
The attack surface is the agent import functionality. When an authenticated user with same-account permissions imports a Bedrock Agent, the toolkit generates Python source code based on configuration values. Because these values are incorporated without safe literal encoding, a crafted configuration can escape the intended data context and be interpreted as executable Python code. The generated source is then executed when the user runs or deploys the imported agent. This is not a remote unauthenticated code execution flaw; it requires an authenticated same-account actor to craft configuration values, and requires user interaction (the victim importing and running or deploying the agent).
The CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. Network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and high impact to confidentiality, integrity, and availability.
A critical operational characteristic is that the vulnerability persists into the generated source. If an agent is imported with an affected version of the toolkit, the generated output artifacts—local and deployed—will contain the injected malicious code even after the toolkit is upgraded. Remediation therefore requires both upgrading to version 0.3.14 and re-importing affected agents to regenerate clean output artifacts. Insufficient technical detail is available regarding the exact configuration key names or the precise encoding routine that fails.
Exploitation Scenarios
No public proof-of-concept is available; the attack chain is inferred from the vulnerability class (CWE-94 code injection via improper code generation).
Reconnaissance / Target Identification: The attacker must possess authenticated access to the same AWS account as the victim. They identify a target environment where the Bedrock AgentCore Starter Toolkit (version < 0.3.14) is in use and where agents are imported, run, or deployed. This may be an internal developer workstation, a CI/CD pipeline, or a shared build environment.
Triggering the Flaw Class: The attacker supplies a crafted configuration value—potentially within an agent configuration that is imported by the toolkit. Because the toolkit does not safely literal-encode configuration values when generating Python source, the crafted value is emitted directly into the generated code. The specific configuration field and the exact injection syntax depend on the toolkit's internal implementation; no public details are available, but generically this would involve a value containing Python expression syntax that breaks out of an intended string literal or data structure.
Payload / Execution Method (class level): When the victim imports the agent and then runs or deploys it, the generated Python source is executed. The injected code embedded in the configuration value is executed in the context of the running user or deployment environment. This permits arbitrary Python code execution on the machine where the toolkit runs or where the agent is deployed.
Post-Exploitation Impact: Successful exploitation grants the attacker code execution under the privileges of the victim user or deployment runtime. This could allow credential theft (e.g., AWS temporary credentials, environment variables), data exfiltration, lateral movement within the cloud environment, or manipulation of deployed agents. Because the malicious code is baked into generated output artifacts, it persists across toolkit upgrades unless the agent is re-imported and output artifacts are replaced.
Impact Assessment
The business impact is severe. CVSS subscores indicate high confidentiality, integrity, and availability impact. A compromised agent deployment could lead to unauthorized access to AWS resources, data tampering, or service disruption. The "changed scope" rating (S:C) indicates the vulnerability in the toolkit can impact resources beyond its own security scope—specifically, the deployed agent's runtime environment and potentially the wider AWS account. The blast radius includes all agents imported and deployed using affected toolkit versions within the account. Because exploitation requires an authenticated same-account actor, the primary threat is from malicious insiders, compromised developer accounts, or supply-chain attacks where an attacker can contribute or modify agent configurations.
Detection Guidance
Sigma Rule
title: Potential Code Injection via Bedrock AgentCore Import
id: 7f8a9b2c-1d3e-4f5a-9b8c-7d6e5f4a3b2c
status: experimental
description: Detects process command lines invoking Python with strings containing configuration values that resemble injected code (e.g., common Python execution functions) related to Bedrock agent import or deployment.
author: Threat Intelligence
date: 2026-01-01
logsource:
category: process_creation
product: linux
detection:
selection_img:
- Image|endswith: '/python'
- Image|endswith: '/python3'
selection_cmd:
CommandLine|contains:
- 'agentcore'
- 'bedrock'
- 'import-agent'
selection_payload:
CommandLine|contains:
- 'exec('
- 'eval('
- '__import__'
- 'subprocess'
- 'os.system'
- 'import os'
condition: selection_img and selection_cmd and selection_payload
fields:
- CommandLine
- ParentCommandLine
- User
falsepositives:
- Legitimate use of these strings in benign scripts
level: high
tags:
- attack.execution
- attack.t1059.006
YARA Rule
rule CVE_2026_105812_Bedrock_AgentCore_CodeInjection
{
meta:
description = "Detects generated Python source with signs of injected code from Bedrock AgentCore import"
author = "Threat Intelligence"
date = "2026-01-01"
reference = "CVE-2026-105812"
severity = "high"
strings:
$s1 = "import os" ascii
$s2 = "import subprocess" ascii
$s3 = "exec(" ascii
$s4 = "eval(" ascii
$s5 = "__import__" ascii
$s6 = "os.system" ascii
$s7 = "base64.b64decode" ascii
$s8 = "socket.socket" ascii
condition:
uint32(0) == 0x6f732023 or $s1 or $s2 or $s3 or $s4 or $s5 or $s6 or $s7 or $s8
}
Suricata IDS Rule
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-105812 Possible Bedrock AgentCore Code Injection via Import"; flow:to_server,established; content:"POST"; http_method; content:"agentcore" ; http_uri; content:"import"; http_uri; pcre:"/(exec|eval|__import__|subprocess|os\.system)/i"; reference:cve,CVE-2026-105812; classtype:web-application-attack; sid:1000001; rev:1;)
Elastic Detection
process where process.name in ("python", "python3") and
process.command_line : ("*exec(*" or "*eval(*" or "*__import__*" or "*os.system*" or "*subprocess*") and
process.command_line : ("*agentcore*" or "*bedrock*" or "*import-agent*")
Splunk SPL Query
index=main (sourcetype=linux_audit OR sourcetype=WinEventLog:Security)
(Image="*python*" OR Image="*python3*")
(CommandLine="*agentcore*" OR CommandLine="*bedrock*" OR CommandLine="*import-agent*")
(CommandLine="*exec(*" OR CommandLine="*eval(*" OR CommandLine="*__import__*" OR CommandLine="*os.system*")
| stats count by host, user, CommandLine, ParentCommandLine
| where count > 0
Wazuh OSSEC Rule
<group name="amazon,bedrock,code_injection,">
<rule id="100001" level="12">
<decoded_as>json</decoded_as>
<field name="process.name">python|python3</field>
<field name="process.command_line">\.*(agentcore|bedrock|import-agent)\.*</field>
<field name="process.command_line">\.*(exec\(|eval\(|__import__|os\.system|subprocess)\.*</field>
<description>CVE-2026-105812: Potential Bedrock AgentCore code injection via crafted configuration values</description>
<mitre>
<id>T1195</id>
<id>T1059.006</id>
</mitre>
</rule>
</group>
Mitigation & Patch Guidance
Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).
Immediate Mitigations:
- Restrict same-account access to agent import functionality. Enforce least privilege so that only trusted roles can import or modify Bedrock Agent configurations.
- Audit recent agent imports and generated source artifacts for anomalous Python code (e.g., exec, eval, subprocess, import).
- Treat all agent configuration inputs as untrusted; validate and sanitize configuration values before import.
- Monitor execution environments for unexpected outbound connections or process creation.
Patch / Upgrade Steps:
- Upgrade the Amazon Bedrock AgentCore Starter Toolkit to version 0.3.14 or later.
- Because the vulnerability persists into generated source, upgrading alone is insufficient. Re-import all agents that were imported with an affected version using the upgraded toolkit.
- Replace both local and deployed output artifacts with freshly generated versions.
- Verify that no residual malicious code remains in deployment packages or runtime environments.
Long-term Hardening:
- Adopt a secure code generation standard that mandates safe literal encoding for all external inputs incorporated into generated source (e.g., using repr() or dedicated template escaping).
- Implement continuous scanning of generated artifacts in CI/CD pipelines for code injection patterns.
- Enforce strict separation of duties for agent import and deployment, and log all import/run/deploy actions.
- Integrate supply-chain risk assessments for all tooling that transforms configuration into executable code.
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105812
- Amazon Web Services Security Bulletins: https://aws.amazon.com/security/security-bulletins/
- CWE-94: Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
- MITRE ATT&CK T1195: Supply Chain Compromise: https://attack.mitre.org/techniques/T1195/
- AWS Bedrock AgentCore Starter Toolkit Release Notes (version 0.3.14)
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.