AWS Bedrock AgentCore SDK Flaws Risk Exposure of Cloud Credentials

Security researchers have identified two vulnerabilities in the Amazon Bedrock AgentCore Python software development kit (SDK) that could allow attackers to execute commands within AI sandboxes. These flaws could lead to the exposure of AWS credentials attached to affected workloads.

The vulnerabilities, which affect the SDK’s Code Interpreter helper used for package installation, have been tracked as CVE-2026-12530 and CVE-2026-16796. Researchers at BeyondTrust discovered that the flaws allow for command injection, potentially granting attackers access to temporary credentials belonging to the Code Interpreter’s execution role.

Technical Bypass of Sandbox Security

The first vulnerability, CVE-2026-12530, affected AgentCore versions 1.1.3 through 1.6.0. BeyondTrust found that a specifically crafted package name could bypass an incomplete character blocklist, effectively turning the package name into a shell command executed inside the sandbox environment.

While AWS initially addressed this flaw in version 1.6.1 by implementing stricter validation rules, a second vulnerability was identified. CVE-2026-16796 affected all SDK versions prior to 1.18.1 and allowed attackers to abuse the package extras syntax in pip to pass shell commands through the new validation rules.

AWS has released version 1.18.1 to resolve both vulnerabilities. The flaws were assigned CVSS 3.1 scores of 7.3 and CVSS 4.0 scores of 8.4.

Impact on Cloud Environments

The potential impact of these flaws depends on the permissions granted to the execution role used by the Code Interpreter. BeyondTrust noted that if these roles have excessive permissions, an attacker could extend their access to other AWS services.

The researchers warned that malicious activity could appear as legitimate application activity within AWS logs. Vulnerable entry points include user-supplied package names, untrusted content processed by an agent, or dependency files located in untrusted repositories.

To mitigate these risks, AWS advises customers to upgrade to version 1.18.1 or later. Security experts also recommend avoiding the use of execution roles that do not require AWS access, tightly scoping identity and access management (IAM) permissions, and monitoring all Code Interpreter activity.