CVE-2026-105812 Code injection in bedrock-agentcore-starter-toolkit
Authenticated users can execute arbitrary code by importing agents with crafted configuration values in the Bedrock AgentCore Starter Toolkit.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-105812?
CVE-2026-105812 is a high-severity code injection vulnerability in aws bedrock-agentcore-starter-toolkit, published on 6 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values incorporated into generated Python source without safe literal encoding.
To remediate this issue, users should upgrade to version 0.3.14. Because this issue persists into generated source, upgrading alone is not sufficient: agents imported with an affected version must be re-imported with version 0.3.14 or later and their local and deployed output artifacts replaced.
Weakness: CWE-94
Which versions are affected by CVE-2026-105812?
How do I fix CVE-2026-105812?
No fix has been published for CVE-2026-105812 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-105812 being exploited?
There is no known exploitation of CVE-2026-105812 in the wild and no public exploit code.