CVE-2026-105812: AgentCore import code injection

In Bedrock AgentCore Starter Toolkit through 0.3.13, crafted same-account agent configuration could be copied into generated Python without safe literal encoding. A second user who imported and then ran or deployed that agent could execute code with their local privileges or the AgentCore runtime role; upgrading alone does not repair previously generated artifacts.^{[1], [2], [3]}

💡 Plain English Explainer (ELI5)

The importer is like a label printer that turns agent settings into Python instructions. Before the fix, it pasted some settings inside quoted text without safely escaping them. A quote in the setting could end the label early, so later characters were read as Python syntax. The fix encodes the setting as a Python string literal, keeping the supplied text as data.^{[2], [5]}

Core Concepts & Subsystem Terms

Agent import: The Starter Toolkit workflow that reads a Bedrock Agent's configuration and generates a local Python project for a framework such as Strands or LangChain.^{[2], [5]}
Code generation: Building source code by combining program templates with values from configuration or other input.^{[2], [5]}
Python string literal: Source notation that represents text as data. repr() returns a quoted representation with characters escaped so they do not become Python syntax.^[5]
CWE-94: Improper control of code generation: input data was inserted into generated source without safe encoding.^{[2], [3]}
Generated artifact: The local or deployed source produced by importing an agent. AWS says affected artifacts must be replaced, not merely left in place after upgrading the importer.^{[1], [2]}

Framework mappings

CWE reference for the weakness described in this guide: CWE-94

Root Cause Analysis

The vulnerable import translator constructed Python source with f-strings and template text that directly interpolated Bedrock agent values, including prompts and other configuration fields. Values containing Python string delimiters could break out of the intended generated string context. The 0.3.14 patch introduces python_string_literal() using repr(str(value)) and a JSON-normalizing python_data_literal(), then routes generated strings and compatible structured data through those encoders. The maintainer advisory bounds the chain: a same-account authenticated principal must be able to modify agent data, another user imports the agent, and the generated project is then run or deployed. The resulting code runs with the importing user's local privileges or the AgentCore Runtime execution role. AWS states that upgrading is insufficient for artifacts generated by affected versions; re-import with 0.3.14 or later and replace local and deployed output. The separate CVE-2026-106032 concerns external OpenAPI references during import and is not this code-generation flaw.

When the generated-code flaw is reachable

Boundary	Documented condition	Defensive action
Toolkit version	Versions through 0.3.13 insert some values into generated Python without safe literal encoding.	Upgrade to 0.3.14 or later, or migrate to @aws/agentcore.
Who can change the data	An authenticated principal in the same AWS account can modify relevant Bedrock Agent fields.	Restrict agent-data write permissions to trusted principals.
Import handoff	A second user imports the modified agent through the affected Starter Toolkit workflow.	Treat agent data from other principals as untrusted; review its provenance before importing.
Execution trigger	The importing user runs or deploys the generated project; code then runs with local privileges or the AgentCore Runtime role.	Import and test with isolated, least-privilege credentials and runtime roles.
Previously generated output	Upgrading the package does not repair projects already generated by affected versions.	Re-import with the fixed version and replace local and deployed artifacts.

Step-by-Step Attack Flow

Step 1

A same-account principal can modify agent data

The prerequisite is an authenticated principal in the AWS account with permissions to change relevant Bedrock Agent fields, such as action-group schemas, collaboration instructions, or prompt overrides.^[2]

Step 2

A second user imports the agent

The affected Starter Toolkit import workflow reads the modified data and generates a Python project. The vulnerability is in the generated source boundary; do not imply that every ordinary import immediately executes the resulting code.^{[2], [5]}

Step 3

Unencoded values enter Python source

In versions through 0.3.13, some free-form configuration values were interpolated into quoted Python template text without safe literal encoding.^{[2], [5]}

Step 4

The generated project is run or deployed

When the user runs or deploys the imported agent, the generated source can execute with the user's local privileges or the AgentCore Runtime execution role.^{[1], [2]}

Step 5

Upgrade and replace generated output

Version 0.3.14 adds Python literal encoding. Re-import with the fixed version and replace both local and deployed outputs; AWS recommends migrating from the deprecated Starter Toolkit to @aws/agentcore.^{[1], [5]}

Source Code: Flaw vs. Secure Implementation

This is a focused upstream diff excerpt: the vulnerable translator interpolated configuration text into a triple-quoted generated Python string; the fix passes the completed text through python_string_literal(), which uses repr() to escape the value as data. The 0.3.14 release applies the same encoding principle to other generated strings and JSON-compatible values, and includes regression tests that parse the output and check that marker text remains a string constant. The excerpt is source analysis, not an injected value or runnable exploit.^{[2], [5]}

Source excerpt: services/import_agent/scripts/base_bedrock_translate.py and services/import_agent/utils.py — focused PRE_PROCESSING prompt hunk

UNPATCHED FLAW

# Before the 0.3.14 fix: the template value entered triple-quoted Python source directly
self.prompts_code += f"""
    PRE_PROCESSING_TEMPLATE=\"""\n
    {config["basePromptTemplate"]["system"]}
    \"""
"""

HARDENED SECURE PATCH

# 0.3.14: encode the complete value as a Python string literal
prompt = f"\n\n    {config['basePromptTemplate']['system']}\n    "
self.prompts_code += f"\n    PRE_PROCESSING_TEMPLATE={python_string_literal(prompt)}\n"

# services/import_agent/utils.py
def python_string_literal(value: Any) -> str:
    return repr(str(value))

Engineering & System Hardening Checklist

✓Inventory developer workstations and CI jobs that use bedrock-agentcore-starter-toolkit; include forks and locally vendored copies, not only the package manifest.^{[1], [2]}
✓Upgrade to version 0.3.14 or later, or migrate to AWS's supported @aws/agentcore CLI; the Starter Toolkit is deprecated.^{[1], [2]}
✓Re-import agents produced with an affected version and replace the generated local and deployed artifacts. A package upgrade alone leaves old generated source in place.^{[1], [2]}
✓Restrict bedrock:CreateAgentActionGroup, bedrock:UpdateAgentActionGroup, and bedrock:AssociateAgentCollaborator to trusted principals, as the maintainer advisory recommends.^[2]
✓Review which Bedrock Agent data-plane fields can be modified by other principals in the account before importing them into a privileged development environment.^[2]
✓Add a regression test that parses generated Python and asserts that controlled marker text appears only in string constants, never as a new assignment or executable statement.^[5]
✓Run imported agents with least-privilege local credentials and runtime roles so a future generator flaw has a bounded impact.^[1]
✓Keep CVE-2026-106032 separate: it is an OpenAPI external-reference SSRF and local-file access issue during import, with its own reader question and source-level fix.^{[6], [9]}