CVE-2026-106032

Executive Summary

CVE-2026-106032 is a server-side request forgery (SSRF) vulnerability in the OpenAPI schema processing of the agent import functionality in the Amazon Bedrock AgentCore Starter Toolkit before version 0.3.14. An authenticated remote actor within the same AWS account can craft external reference values in OpenAPI content associated with a Bedrock Agent action group, causing the environment of a user importing a Bedrock Agent to issue arbitrary outbound requests and read arbitrary local files. With a CVSS score of 5.7, the vulnerability requires user interaction and low privileges, resulting in high confidentiality impact but no integrity or availability impact.

Technical Analysis

The vulnerability resides in the OpenAPI schema processing logic within the agent import functionality of the bedrock-agentcore-starter-toolkit, specifically prior to version 0.3.14. The flaw is classified as CWE-918: Server-Side Request Forgery (SSRF). The attack surface is the import operation where a Bedrock Agent's OpenAPI content is processed, and external reference values within that content are resolved by the importing environment.

The mechanism: When a user imports a Bedrock Agent, the toolkit parses the associated OpenAPI schema content, which may contain external references (e.g., $ref directives pointing to external URLs). Due to insufficient validation or sanitization of these reference values, the processing environment can be induced to make outbound HTTP requests to attacker-controlled destinations and to read local files. The vulnerability is triggered by crafted external reference values embedded in the OpenAPI content associated with an action group. This allows an authenticated actor in the same AWS account to leverage the trust relationship of the victim user who performs the import, effectively using the victim's environment as a proxy for SSRF and local file disclosure.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N indicates: network attack vector, low attack complexity, low privileges required, user interaction required (the victim must import the malicious agent), scope unchanged, high confidentiality impact, no integrity or availability impact. The user interaction requirement reflects that the victim must initiate the import of the malicious Bedrock Agent.

The affected component is the bedrock-agentcore-starter-toolkit (deprecated) before 0.3.14. The supported replacement, @aws/agentcore npm CLI, does not contain this issue.

Exploitation Scenarios

No public proof-of-concept (PoC) or exploit code is available. The attack chain is inferred from the vulnerability class (SSRF via external references in OpenAPI schema processing) and the NVD description.

1. Reconnaissance / Target Identification: The attacker, an authenticated remote actor with access to the same AWS account as the victim, identifies a target user who uses the vulnerable bedrock-agentcore-starter-toolkit (version < 0.3.14) to import Bedrock Agents. The attacker must have the ability to create or modify a Bedrock Agent and its associated action group, including the OpenAPI schema content.

2. Triggering the Flaw: The attacker crafts an OpenAPI schema document that includes malicious external reference values (e.g., $ref pointing to an internal endpoint or a file:// URI). This schema is associated with an action group of a Bedrock Agent that the attacker controls or can influence. The attacker then induces or waits for the victim to import this agent using the vulnerable toolkit. The import process resolves the external references without adequate validation, causing the victim's environment to issue arbitrary outbound requests (SSRF) and read local files.

3. Payload / Execution Method (vulnerability-class level): At the vulnerability-class level, the payload consists of crafted external reference values embedded in the OpenAPI content. When the toolkit processes the OpenAPI schema during import, it follows these references, resulting in SSRF to arbitrary destinations (potentially internal AWS metadata endpoints, internal services, or attacker-controlled servers) and local file reads via file URI schemes. The exact syntax and supported schemes are not detailed in the NVD description; therefore, specific implementation details cannot be provided.

4. Post-Exploitation Impact: Successful exploitation allows the attacker to cause the victim's environment to make outbound requests, which can be used to probe internal networks, access cloud instance metadata (e.g., IAM credentials), or exfiltrate data to attacker-controlled endpoints. Additionally, arbitrary local file reads can expose sensitive files on the victim's filesystem, such as configuration files, credentials, or source code. The impact is limited to confidentiality (C:H) with no integrity or availability impact, and the scope is unchanged.

Impact Assessment

The business impact of CVE-2026-106032 includes potential unauthorized access to sensitive data through SSRF and local file disclosure. Affected systems are those where users import Bedrock Agents using the vulnerable bedrock-agentcore-starter-toolkit (versions < 0.3.14). The blast radius is constrained to the same AWS account, as the attacker must be an authenticated remote actor within that account. The CVSS subscores indicate high confidentiality impact (C:H), meaning sensitive information could be exposed, but no integrity (I:N) or availability (A:N) impact. The attack requires user interaction (UI:R), as the victim must perform the import. The low privileges (PR:L) and network vector (AV:N) make it exploitable by a relatively low-privileged insider or compromised account within the account boundary. The scope is unchanged (S:U), so the impact does not cross security boundaries beyond the vulnerable component. Overall, the vulnerability poses a moderate risk (CVSS 5.7) to organizations using the deprecated toolkit, particularly in multi-tenant or shared AWS account environments where users may import agents from less-trusted sources.

Detection Guidance

Sigma Rule

title: Potential SSRF via OpenAPI External References in Bedrock Agent Import
id: 7c3e9f2a-1b4d-4e8a-9c5f-2d6b7e8f9a0b
status: experimental
description: Detects import of Bedrock Agent with OpenAPI content containing external references that may trigger SSRF in vulnerable bedrock-agentcore-starter-toolkit.
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName:
      - ImportAgent
      - CreateAgentActionGroup
      - UpdateAgentActionGroup
    requestParameters:
      - '*$ref*'
      - '*http://*'
      - '*https://*'
      - '*file://*'
      - '*169.254.169.254*'
  condition: selection
falsepositives:
  - Legitimate use of external references in OpenAPI schemas.
level: medium

YARA Rule

rule CVE_2026_106032_SSRF_OpenAPI_Ref
{
    meta:
        description = "Detects OpenAPI schemas with external references that may trigger SSRF in bedrock-agentcore-starter-toolkit"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-106032"
    strings:
        $ref1 = "$ref" ascii wide nocase
        $url1 = "http://" ascii wide nocase
        $url2 = "https://" ascii wide nocase
        $file = "file://" ascii wide nocase
        $meta = "169.254.169.254" ascii wide nocase
    condition:
        $ref1 and any of ($url*, $file, $meta)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106032 Potential SSRF via OpenAPI External Reference in Bedrock Agent Import"; flow:to_server,established; content:"$ref"; http_client_body; nocase; pcre:"/(http|https|file):\/\//i"; reference:cve,CVE-2026-106032; classtype:attempted-recon; sid:10000001; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.name : ("bedrock-agentcore-starter-toolkit*", "agentcore*")]
  [network where destination.ip != null and (destination.ip == "169.254.169.254" or network.direction == "outbound")]

Splunk SPL Query

index=aws sourcetype=aws:cloudtrail eventName IN ("ImportAgent", "CreateAgentActionGroup", "UpdateAgentActionGroup")
| search requestParameters="*$ref*" OR requestParameters="*http://*" OR requestParameters="*https://*" OR requestParameters="*file://*" OR requestParameters="*169.254.169.254*"
| table _time, userIdentity.arn, eventName, requestParameters, sourceIPAddress
| sort - _time

Wazuh OSSEC Rule

<group name="aws,bedrock,">
  <rule id="100101" level="10">
    <decoded_as>json</decoded_as>
    <field name="eventName">ImportAgent|CreateAgentActionGroup|UpdateAgentActionGroup</field>
    <field name="requestParameters">\$ref|http://|https://|file://|169\.254\.169\.254</field>
    <description>CVE-2026-106032: Potential SSRF via OpenAPI external reference in Bedrock Agent import</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict the ability to create or modify Bedrock Agents and action groups to trusted principals only.
   • Validate and sanitize OpenAPI schemas before import, disallowing external references (e.g., $ref to external URLs or file:// URIs) unless explicitly trusted.
   • Monitor CloudTrail logs for ImportAgent, CreateAgentActionGroup, and UpdateAgentActionGroup events containing suspicious external references.
   • Implement network egress filtering to block outbound requests to internal metadata endpoints (e.g., 169.254.169.254) and untrusted destinations.
   • Enforce least privilege to limit the blast radius of SSRF.

2. Patch/Upgrade Steps:

   • Upgrade bedrock-agentcore-starter-toolkit to version 0.3.14 or later. Note that this product is deprecated.
   • Migrate to the supported replacement, the @aws/agentcore npm CLI, which does not contain this issue. This is the recommended long-term path.

3. Long-Term Hardening:

   • Adopt secure software supply chain practices, including regular dependency scanning and updates.
   • Implement strict validation of all external inputs, especially in schema processing and import functionalities.
   • Use AWS IAM policies to enforce separation of duties and limit cross-user impact within the same account.
   • Conduct security reviews of custom and third-party tooling that processes OpenAPI schemas.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106032
• AWS Security Advisory (if available): [No specific advisory URL provided; refer to AWS security bulletins]
• CWE-918: https://cwe.mitre.org/data/definitions/918.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• No known threat actor campaigns or exploit-in-the-wild evidence have been reported for this CVE. CISA KEV status: NO.