CVE-2026-105812

Name of the Vulnerable Software and Affected Versions Amazon Bedrock AgentCore Starter Toolkit versions prior to 0.3.14

Description Improper control of code generation within the agent import functionality allows an authenticated actor within the same account to execute arbitrary code. This occurs when a user imports and runs or deploys a Bedrock Agent using crafted configuration values that are incorporated into generated Python source code without safe literal encoding.

Recommendations Upgrade to version 0.3.14. Re-import agents that were imported with an affected version using version 0.3.14 or later and replace their local and deployed output artifacts.