CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF
Amazon Bedrock ยท 2026-10-06
Actions
Technical Details
| Affected Versions | >= 0.1.4, <= 0.3.13 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-105812, CVE-2026-106032 |
| Breaking Change | Yes |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update Bedrock AgentCore Starter Toolkit to version 0.3.14 and re-import affected agents to address critical security vulnerabilities (CVE-2026-105812 and CVE-2026-106032).
For Platform Teams
Migrate to the replacement tooling, AgentCore CLI (@aws/agentcore), to incorporate equivalent fixes for code injection and SSRF vulnerabilities.
For Executives
Implement immediate upgrades to Bedrock AgentCore Starter Toolkit to version 0.3.14 to mitigate security risks associated with code injection and SSRF vulnerabilities.
Source
Related Amazon Bedrock Updates
- GLM 5.3 by Z.ai is now generally available on Amazon Bedrock (2026-10-05)
- Introducing GLM 5.3 on Amazon Bedrock (2026-10-05)
- AgentCore Gateway supports private TLS certificates for VPC endpoints (2026-10-02)
- Build a multi-agent music production pipeline on Amazon Bedrock AgentCore Runtime Instances (2026-09-30)
- Amazon Bedrock expands Claude models in-region support in the UK (London) (2026-09-30)