CVE-2026-16796: Command Argument Injection in AWS Bedrock AgentCore SDK

Vulnerability ID: CVE-2026-16796
CVSS Score: 7.3
Published: 2026-07-24

An argument injection vulnerability in the AWS Bedrock AgentCore Python SDK allows authenticated users to execute arbitrary commands inside the Code Interpreter sandbox container via crafted Python package specifiers containing shell metacharacters.

TL;DR

A weakly validated package extras regex in bedrock-agentcore allows command execution inside the Code Interpreter sandbox via crafted package install requests.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-88
• Attack Vector: Network
• CVSS v3.1: 7.3
• EPSS Score: 0.00327
• Exploit Status: poc
• KEV Status: Not Listed

Affected Systems

• AWS Bedrock AgentCore Python SDK (bedrock-agentcore)
• bedrock-agentcore: >= 1.6.0, < 1.18.1 (Fixed in: 1.18.1)

Code Analysis

Commit: 3c4b4ee

Fix: Command injection vulnerability in packages installation

@@ -20,8 +21,11 @@\n VALID_PACKAGE_NAME = re.compile(\n-    r"^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(\\[.*\\])?(==|>=|<=|!=|~=|>|<)?[a-zA-Z0-9.*]*$"\n+    r"^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(\\[[a-zA-Z0-9._,\\-]*\\])?(==|>=|<=|!=|~=|>|<)?[a-zA-Z0-9.*]*$"\n )

Mitigation Strategies

• Upgrade the bedrock-agentcore library to version 1.18.1 or newer.
• Enforce network egress isolation on the Code Interpreter container execution environment.
• Validate packages using strict PEP 508 schema structures in upstream application code.

Remediation Steps:

1. Identify all Python deployments containing the bedrock-agentcore dependency.
2. Update requirements.txt, setup.py, or pyproject.toml to lock bedrock-agentcore to >= 1.18.1.
3. Re-run dependency resolution pipelines to compile clean lockfiles.
4. Deploy the updated codebase and verify the validation behavior of the SDK.

References

• AWS Security Bulletin - 2026-065
• GitHub Security Advisory GHSA-j6g5-3hh3-pgw8
• Pull Request #581: Package verification improvement

Read the full report for CVE-2026-16796 on our website for more details including interactive diagrams and full exploit analysis.