Bedrock AgentCore Toolkit CVE-2026-106032

Exploitation requires the attacker to be an authenticated actor within the same AWS account as the victim (PR:L), and requires the victim to actively import a Bedrock Agent whose action group's associated OpenAPI content contains attacker-crafted external reference values that the toolkit's schema processor will resolve (UI:A / AT:P). It is limited to Amazon Bedrock AgentCore Starter Toolkit versions before 0.3.14; the supported replacement, the @aws/agentcore npm CLI, does not contain this issue. The principal limiting factors are therefore same-account authentication, the mandatory victim import action, and the narrow affected-version window - all of which prevent unauthenticated or non-interactive exploitation.

The vendor-supplied CVSS 4.0 vector (5.7, Medium) tells a consistent, low-urgency story: exploitation is network-reachable (AV:N) and technically simple (AC:L), but gated by three real constraints - the attacker must already be an authenticated principal in the SAME AWS account (PR:L), a specific attack condition must hold (AT:P, i.e. a crafted OpenAPI external reference in an action group), and a victim must actively perform an import action (UI:A). Impact is confined to confidentiality (VC:H via arbitrary local file read and SSRF-driven outbound requests), with no integrity or availability impact (VI:N/VA:N) and no scope change to subsequent systems (SC/SI/SA:N). Exploitation status: no public exploit identified at time of analysis - there is no KEV listing and no POC flag in the provided data, and no EPSS score was supplied, so widespread or opportunistic exploitation cannot be inferred. This is a genuine but bounded insider/same-account threat, not an internet-facing mass-exploitation risk; the combination of required same-account authentication plus victim interaction makes it a lower real-world priority than its CWE-918 (SSRF) class might suggest. Signals are mutually consistent - no contradiction between the vector and the description - though the absence of EPSS/KEV/POC means the exploitation-likelihood dimension is simply unmeasured rather than confirmed-low.

A malicious or compromised principal already authenticated within the same AWS account crafts a Bedrock Agent action group whose associated OpenAPI content contains hostile external reference ($ref) values. When a legitimate user imports that Bedrock Agent using the AgentCore Starter Toolkit (before 0.3.14), the toolkit's schema processor resolves those references, causing the victim's environment to issue arbitrary outbound requests and disclose arbitrary local files. No public exploit code is identified at time of analysis; exploitation requires the victim to perform the import action.