The flaws, tracked as CVE-2026-12530 and CVE-2026-16796, affected the SDK’s install_packages() helper, which enables AI agents to install Python libraries inside managed Code Interpreter sessions. AWS has urged customers to upgrade bedrock-agentcore to version 1.18.1 or later, the release that closes both attack paths.
Security researcher Sergio Garcia of BeyondTrust Phantom Labs discovered the first weakness while examining how package names supplied to install_packages() were validated before being inserted into a pip install shell command. The SDK blocked several shell metacharacters but failed to reject newline characters, allowing a specially crafted package name to introduce a second command.
BeyondTrust said successful exploitation produced remote command execution within the Code Interpreter sandbox. Where a customer had configured an execution role for the interpreter, code running in that environment could query the microVM Metadata Service and retrieve the role’s temporary AWS credentials.
AWS classified CVE-2026-12530 as high severity. It affected bedrock-agentcore versions from 1.1.3 through versions earlier than 1.6.1. AWS released version 1.6.1 on April 10 after replacing the original character blocklist with stricter package-name validation, and formally disclosed the vulnerability on June 17.
Further testing showed that the first correction could still be bypassed. Garcia found that command substitution could be placed inside pip “extras” syntax and pass the revised validation, creating another route to arbitrary command execution. AWS assigned the bypass a separate identifier, CVE-2026-16796.
The second vulnerability affected versions earlier than 1.18.1 and was disclosed by AWS on July 23. Version 1.18.1, released on July 17, strengthened the validation rules and changed command construction so package names were quoted before being passed to the shell. AWS said customers using version 1.18.1 or later require no further action for the two issues.
Both vulnerabilities received a CVSS 4.0 score of 8.4 and a CVSS 3.1 score of 7.3, placing them in the high-severity range. Exploitation required an authenticated user capable of influencing package-name arguments passed to install_packages(), meaning the flaws did not provide unauthenticated access to AgentCore environments.
The potential consequences depended heavily on the permissions assigned to the Code Interpreter execution role. AWS documentation states that credentials for configured execution roles are available within the underlying microVM through its metadata service, and warns that any code or actor running inside the VM can access them.
That design allows code executing legitimately in a sandbox to call permitted AWS services, but it also means command injection can become credential exposure when an execution role is attached. The permissions available to stolen temporary credentials would be limited by the policies granted to that role, making least-privilege configuration an important containment measure.
AWS advises customers to scope AgentCore execution roles only to permissions their workloads require. Its security guidance also says customers should avoid privilege-escalation paths by ensuring a resource’s execution role has equal or fewer privileges than users allowed to invoke it.
For organisations unable to upgrade immediately, AWS recommends that applications avoid passing untrusted or model-generated strings to install_packages(). For the earlier flaw, it advised restricting package installation to a fixed, hardcoded list of approved names. For the later bypass, AWS said dynamic names should be checked against strict Python Package Index naming rules, including tighter validation of extras groups.
BeyondTrust said the original issue was reported to AWS on March 28 through its vulnerability disclosure programme. AWS reproduced the finding and classified it as high severity on April 9. After the first patch, the researchers identified the bypass on June 24, leading to the broader correction in July.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
