Which versions of AgentCore CLI are affected by CVE-2026-11393?

AWS AgentCore CLI contains a critical remote code execution vulnerability (CVSS 9.0) affecting authenticated users who import malicious Bedrock Agent collaborators.. A patch is available.

Is there a public PoC exploit available for CVE-2026-11393?

Yes, a public proof-of-concept exploit is available for CVE-2026-11393. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11393?

Within 24 hours: Inventory all AWS AgentCore CLI installations and document current versions across the organization. Within 7 days: Update all instances of AWS AgentCore CLI to v0.14.2 or later. Within 30 days: Audit imported Bedrock Agent collaborators for suspicious collaborationInstruction payloads; review IAM role activities during vulnerability window for signs of exploitation.

AgentCore CLI CVE-2026-11393

Q: What is the CVSS score of CVE-2026-11393?

CVE-2026-11393 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35187 HIGH

Code Injection (CWE-94)

2026-06-08 AMZN

GHSA-m4x6-gwgp-4pm7

RCE Python AWS Code Injection Agentcore Cli

8.8

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (AMZN) · only source for this CVE.

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

Jun 08, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

Jun 08, 2026 - 19:22 NVD

CRITICAL HIGH

CVSS changed

Jun 08, 2026 - 19:22 NVD

9.0 (CRITICAL) 8.8 (HIGH)

Source Code Evidence Fetched

Jun 08, 2026 - 19:22 vuln.today

Analysis Generated

Jun 08, 2026 - 19:22 vuln.today

DescriptionCVE.org

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.

To remediate this issue, users should upgrade to version 0.14.2.

AnalysisAI

Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via crafted collaborationInstruction strings stored on Bedrock Agent collaborators. When another user in the same AWS account imports the agent, the malicious triple-quote payload breaks out of the generated Python docstring and executes attacker-controlled code on AWS AgentCore Runtime under the imported agent's IAM execution role, as well as on the importing user's local environment. No public exploit identified at time of analysis, but the cross-user, cross-environment scope and 9.0 CVSS rating make this a high-priority patch.

Technical ContextAI

AgentCore CLI is the AWS command-line tool (distributed via npm as @aws/agentcore) for managing Amazon Bedrock multi-agent workflows, including importing existing Bedrock Agent collaborators. During import, the CLI generates Python source code that embeds the collaborationInstruction field - supplied by the upstream collaborator agent - inside a triple-quoted Python string (docstring). The CWE-94 root cause is improper neutralization of triple-quote characters (""") in this code-generation step: an attacker who controls the collaborationInstruction can close the docstring and append arbitrary Python statements that the generator emits verbatim. The upstream fix in PR #1329 ("escape triple-quotes in collaborationInstruction to prevent docstring injection") confirms this is a classic code-generation injection bug rather than a runtime eval flaw. The affected CPE is cpe:2.3:a:aws:agentcore_cli:*, and the same fix landed in the 1.0.0-preview.9 preview line.

RemediationAI

Vendor-released patch: upgrade AgentCore CLI to v0.14.2 (npm install -g @aws/agentcore@0.14.2) or, if tracking the preview line, to 1.0.0-preview.9; the fix is PR #1329 which escapes triple-quote sequences in collaborationInstruction before they are embedded in generated Python. Patched releases are available at https://github.com/aws/agentcore-cli/releases/tag/v0.14.2 and https://www.npmjs.com/package/@aws/agentcore/v/0.14.2, with vendor guidance at https://aws.amazon.com/security/security-bulletins/2026-040-aws/. Until upgrade is complete, compensating controls include restricting which IAM principals can write to collaborationInstruction on shared Bedrock Agent collaborators (via IAM policy on bedrock:UpdateAgentCollaborator and related actions), reviewing collaborationInstruction values for triple-quote characters or Python syntax before running agentcore import, and running imports only inside isolated workstations or sandboxed roles so that any code execution is contained - the trade-off is operational friction for teams that legitimately share Bedrock collaborators across accounts.