CVE-2026-16796
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
Risk Assessment
An attacker with API access could execute arbitrary commands in the sandbox environment, potentially compromising data integrity and confidentiality.
Recommendation
Update AWS Bedrock AgentCore Python SDK to version 1.18.1 or later.
Other vulnerabilities in AWS Bedrock AgentCore Python SDK
See all- CVE-2026-15737Medium
A vulnerability in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 causes unintended logging of sensitive user content to CloudWatch Logs. The SDK writes raw user prompts and agent responses as OpenTelemetry span attributes without filtering or masking.
- CVE-2026-12530High
The install_packages() method in AWS Bedrock AgentCore Python SDK versions >= 1.1.3 and < 1.6.1 has improper neutralization of argument delimiters, which may allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
Original NVD description (English source)
Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, users should upgrade to the patched version 1.18.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS